4b91229d9f668259d2e9d18b5d285287bba42fe814372a0b57e3bbcf3250cb62

Sharing

Copy URL Twitter E-mail

General

Target

4b91229d9f668259d2e9d18b5d285287bba42fe814372a0b57e3bbcf3250cb62
Size

25KB
MD5

8e876ec7c08ab0887c1d30d1edfaa6ee
SHA1

c6ad068fdea91e5b3a44701e917c173dc50d4c2c
SHA256

4b91229d9f668259d2e9d18b5d285287bba42fe814372a0b57e3bbcf3250cb62
SHA512

f528262f0496a169aae01707a04a5ce91ec847b9a5a4425cb25ea1ade412b35a4db7259607e8c279f600f078fddd892faca2ea05a23c6f9124b246360d14d969
SSDEEP

384:lJLJi4Pir72xb9sO44HWWaibbKfPPEOn/sdZQ6ooEeSvPhUXTSp9ANMwgn:ll6rCxhsOPTkPTnodDNMbn

Score

1^/10

Malware Config

Signatures

Files

4b91229d9f668259d2e9d18b5d285287bba42fe814372a0b57e3bbcf3250cb62
.sys windows:10 windows x86 arch:x86

401349bf9d24f6752a844c9480a94e4d

Code Sign

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:fa
Certificate

Issuer

CN=WDKTestCert dy\,133666952321935811

Not Before

29/07/2024, 02:53

Not After

29/07/2034, 00:00

Subject

CN=WDKTestCert dy\,133666952321935811

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

bb:fe:35:12:80:81:b5:a3:2b:3f:e9:f5:65:00:ff:38:07:2d:30:9a
Signer

Actual PE Digest

bb:fe:35:12:80:81:b5:a3:2b:3f:e9:f5:65:00:ff:38:07:2d:30:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\dy\Desktop\CHRU41101\Release\CHRU41X01.pdb

Imports

ntoskrnl.exe

memset
READ_REGISTER_ULONG
WRITE_REGISTER_ULONG
ExAllocatePoolWithTag
MmMapIoSpace
IoGetDmaAdapter
DbgPrint
memcpy
KeSetEvent
READ_REGISTER_UCHAR
READ_REGISTER_USHORT
WRITE_REGISTER_USHORT
ObReferenceObjectByHandleWithTag
KeBugCheckEx
swprintf
ObfDereferenceObject
IoGetDeviceProperty
IoWMIRegistrationControl
MmUnmapIoSpace
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ExFreePoolWithTag
KeInitializeSpinLock
WRITE_REGISTER_UCHAR
RtlInitUnicodeString

hal

READ_PORT_ULONG
WRITE_PORT_ULONG
KfAcquireSpinLock
KfReleaseSpinLock

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

401349bf9d24f6752a844c9480a94e4d

Code Sign

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:faCertificate

Extended Key Usages

Key Usages

bb:fe:35:12:80:81:b5:a3:2b:3f:e9:f5:65:00:ff:38:07:2d:30:9aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 2KB

PAGE Size: 4KB - Virtual size: 4KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:fa
Certificate

bb:fe:35:12:80:81:b5:a3:2b:3f:e9:f5:65:00:ff:38:07:2d:30:9a
Signer

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 2KB

PAGE
Size: 4KB - Virtual size: 4KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB