ec8483b08c2cffd7621abcbceb1e4e98d8dbee6c00bac3a969cb62610fc22988

Sharing

Copy URL Twitter E-mail

General

Target

ec8483b08c2cffd7621abcbceb1e4e98d8dbee6c00bac3a969cb62610fc22988
Size

17KB
MD5

40a6261f3a182257ad99a0f1c30a58ae
SHA1

bf0d39483253a8a2c44f9126c2ec9180c9463588
SHA256

ec8483b08c2cffd7621abcbceb1e4e98d8dbee6c00bac3a969cb62610fc22988
SHA512

ac154f74059f542d82686d95b0f59274c8bd92000f50138d3678e7aa25529b2602509e0d571f33e289d468629bfc5982796adc26ef90fdf895f2cb3d84eb577a
SSDEEP

384:fu4RGacFSsJEgfxMW87et6nvKzCKWm31Vc9BplEPoSwt:ZxzMGEC+kBfEPoSwt

Score

1^/10

Malware Config

Signatures

Files

ec8483b08c2cffd7621abcbceb1e4e98d8dbee6c00bac3a969cb62610fc22988
.sys windows:10 windows x64 arch:x64

c89edd9c24a0785b05e27994ed3df44d

Code Sign

42:d2:bc:b4:53:59:b1:93:47:4f:af:69:44:5f:62:9f
Certificate

Issuer

CN=WDKTestCert timot\,133680695057113941

Not Before

14/08/2024, 00:38

Not After

13/08/2034, 00:00

Subject

CN=WDKTestCert timot\,133680695057113941

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

8d:c3:d5:6f:b6:e8:88:d5:60:41:3a:15:59:2d:eb:3e:76:78:e3:ac:c9:41:cc:9f:2e:66:00:55:cc:4d:eb:50
Signer

Actual PE Digest

8d:c3:d5:6f:b6:e8:88:d5:60:41:3a:15:59:2d:eb:3e:76:78:e3:ac:c9:41:cc:9f:2e:66:00:55:cc:4d:eb:50

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\timot\source\repos\kernel driver\kernel driver\x64\Debug\kerneldriver.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeGetCurrentIrql
IoWMIRegistrationControl
MmGetSystemRoutineAddress
RtlInitUnicodeString
DbgPrintEx

wpprecorder.sys

WppAutoLogStop
imp_WppRecorderReplay
WppAutoLogTrace
WppAutoLogStart

wdfldr.sys

WdfVersionUnbindClass
WdfVersionBindClass
WdfVersionUnbind
WdfLdrQueryInterface
WdfVersionBind

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c89edd9c24a0785b05e27994ed3df44d

Code Sign

42:d2:bc:b4:53:59:b1:93:47:4f:af:69:44:5f:62:9fCertificate

Extended Key Usages

Key Usages

8d:c3:d5:6f:b6:e8:88:d5:60:41:3a:15:59:2d:eb:3e:76:78:e3:ac:c9:41:cc:9f:2e:66:00:55:cc:4d:eb:50Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

wpprecorder.sys

wdfldr.sys

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 912B

.pdata Size: 512B - Virtual size: 480B

PAGE Size: 4KB - Virtual size: 3KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 60B

42:d2:bc:b4:53:59:b1:93:47:4f:af:69:44:5f:62:9f
Certificate

8d:c3:d5:6f:b6:e8:88:d5:60:41:3a:15:59:2d:eb:3e:76:78:e3:ac:c9:41:cc:9f:2e:66:00:55:cc:4d:eb:50
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 912B

.pdata
Size: 512B - Virtual size: 480B

PAGE
Size: 4KB - Virtual size: 3KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 60B