a138a9668ba4b1d6bdf13f56878e4da127f6c68900c4d157a18a653ec91c47de

Sharing

Copy URL Twitter E-mail

General

Target

a138a9668ba4b1d6bdf13f56878e4da127f6c68900c4d157a18a653ec91c47de
Size

42KB
MD5

8fd9b51fec27a6579ef12bac1b5fb264
SHA1

f9d465054c1bb5788c72dda5fe5fad6750aa9b77
SHA256

a138a9668ba4b1d6bdf13f56878e4da127f6c68900c4d157a18a653ec91c47de
SHA512

6e4eb096499b220e59c30929949080b04f9b9247a5b6bc0bc3d08636ce9c6d8563797aa81f1d9d1836d124b56da7ba849eb44ff2e66ef315ec054c12d3112087
SSDEEP

768:j5G3ajDh/WPCMh6i/9h4NJb81bv5oMIvcRE:1G8bQh4NJb8J5ov0RE

Score

1^/10

Malware Config

Signatures

Files

a138a9668ba4b1d6bdf13f56878e4da127f6c68900c4d157a18a653ec91c47de
.sys windows:10 windows x64 arch:x64

712a097a606d6d7f28b904b87d4fb842

Code Sign

41:ad:94:38:ab:da:64:9d:4c:a3:36:85:76:9f:50:50
Certificate

Issuer

CN=WDKTestCert Admin\,133673035376815384

Not Before

05/08/2024, 03:52

Not After

05/08/2034, 00:00

Subject

CN=WDKTestCert Admin\,133673035376815384

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

f4:3b:0b:9a:1d:14:45:ba:66:e8:37:03:97:cb:22:14:24:39:fa:40:62:b7:b0:5e:30:f9:b2:6a:37:0d:76:7c
Signer

Actual PE Digest

f4:3b:0b:9a:1d:14:45:ba:66:e8:37:03:97:cb:22:14:24:39:fa:40:62:b7:b0:5e:30:f9:b2:6a:37:0d:76:7c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Admin\Desktop\MyDriver1 (3)\x64\Release\MyDriver1.pdb

Imports

fltmgr.sys

FltUnregisterFilter
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor
FltRegisterFilter

ntoskrnl.exe

wcsrchr
RtlInitUnicodeString
RtlWriteRegistryValue
RtlCreateRegistryKey
DbgPrintEx
MmIsAddressValid
_vsnwprintf
wcsstr
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExAllocatePool
ExFreePoolWithTag
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetRelatedDeviceObject
IoSetCompletionRoutineEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwOpenFile
ZwWriteFile
ZwClose
ZwOpenKey
ZwQueryValueKey
KeStackAttachProcess
KeUnstackDetachProcess
IoFileObjectType
RtlInitAnsiString
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlFreeAnsiString
RtlGetVersion
MmGetPhysicalMemoryRanges
MmGetPhysicalAddress
MmCopyMemory
MmGetVirtualForPhysical
PsSetCreateProcessNotifyRoutine
PsGetProcessId
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsGetProcessPeb
__C_specific_handler
PsProcessType

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

712a097a606d6d7f28b904b87d4fb842

Code Sign

41:ad:94:38:ab:da:64:9d:4c:a3:36:85:76:9f:50:50Certificate

Extended Key Usages

Key Usages

f4:3b:0b:9a:1d:14:45:ba:66:e8:37:03:97:cb:22:14:24:39:fa:40:62:b7:b0:5e:30:f9:b2:6a:37:0d:76:7cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

fltmgr.sys

ntoskrnl.exe

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 23KB - Virtual size: 35KB

.pdata Size: 512B - Virtual size: 492B

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 36B

41:ad:94:38:ab:da:64:9d:4c:a3:36:85:76:9f:50:50
Certificate

f4:3b:0b:9a:1d:14:45:ba:66:e8:37:03:97:cb:22:14:24:39:fa:40:62:b7:b0:5e:30:f9:b2:6a:37:0d:76:7c
Signer

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 23KB - Virtual size: 35KB

.pdata
Size: 512B - Virtual size: 492B

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 36B