287bdf5d7fba7fe1a5e46ca40204559e554c41cf4f4e45c9363e3a25e03190aa

Sharing

Copy URL Twitter E-mail

General

Target

287bdf5d7fba7fe1a5e46ca40204559e554c41cf4f4e45c9363e3a25e03190aa
Size

21KB
MD5

78d87a33d32a3a5467d53bf7e25aa410
SHA1

d6082d36d2d90c6b863d70dc1108a6923a866a9f
SHA256

287bdf5d7fba7fe1a5e46ca40204559e554c41cf4f4e45c9363e3a25e03190aa
SHA512

f0e40bc9cd5918a2c0cbeac2e68d2dc27c259d94845143e72a562e96701dd74999de4c654d8c414550ed3268c18865e81c17cd15151ee80a051b832a5d485d39
SSDEEP

384:6R+MY6abZKti+pUrygoS03Y/6M405BIuKUbjElynEPrX7DN:6w1Ei+pA03Yr40wnFlyEzF

Score

1^/10

Malware Config

Signatures

Files

287bdf5d7fba7fe1a5e46ca40204559e554c41cf4f4e45c9363e3a25e03190aa
.sys windows:10 windows x64 arch:x64

1af5f7a66793cf97aa607085490808fd

Code Sign

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:fa
Certificate

Issuer

CN=WDKTestCert dy\,133666952321935811

Not Before

29/07/2024, 02:53

Not After

29/07/2034, 00:00

Subject

CN=WDKTestCert dy\,133666952321935811

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

fc:23:47:eb:ed:bd:a6:45:f0:fc:aa:64:79:29:85:6e:0c:f6:b9:7d:c8:63:0f:e1:28:d3:85:6c:35:76:7b:39
Signer

Actual PE Digest

fc:23:47:eb:ed:bd:a6:45:f0:fc:aa:64:79:29:85:6e:0c:f6:b9:7d:c8:63:0f:e1:28:d3:85:6c:35:76:7b:39

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\dy\Desktop\CANX20\Release\CANX20.pdb

Imports

ntoskrnl.exe

swprintf
MmGetSystemRoutineAddress
MmMapIoSpace
KeSetEvent
KeAcquireSpinLockRaiseToDpc
IoGetDeviceProperty
ObReferenceObjectByHandle
ObfDereferenceObject
ExEventObjectType
KeBugCheckEx
MmUnmapIoSpace
RtlCopyUnicodeString
ExFreePoolWithTag
ExAllocatePoolWithTag
KeReleaseSpinLock
RtlInitUnicodeString

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1af5f7a66793cf97aa607085490808fd

Code Sign

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:faCertificate

Extended Key Usages

Key Usages

fc:23:47:eb:ed:bd:a6:45:f0:fc:aa:64:79:29:85:6e:0c:f6:b9:7d:c8:63:0f:e1:28:d3:85:6c:35:76:7b:39Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 512B - Virtual size: 432B

PAGE Size: 4KB - Virtual size: 3KB

INIT Size: 1024B - Virtual size: 946B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 40B

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:fa
Certificate

fc:23:47:eb:ed:bd:a6:45:f0:fc:aa:64:79:29:85:6e:0c:f6:b9:7d:c8:63:0f:e1:28:d3:85:6c:35:76:7b:39
Signer

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 432B

PAGE
Size: 4KB - Virtual size: 3KB

INIT
Size: 1024B - Virtual size: 946B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 40B