tempagentfn[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

tempagentfn.sys
Size

17KB
MD5

f51a2a3701c953f5933956f4fed61064
SHA1

e63ea874a243ce35ffe53254a4dc131b090f9004
SHA256

6a9e517b89af36bba64422a3e892340006398443369bdfa8950bcea66b911793
SHA512

3fbfa817f343c2b5ad8fdfb02e8314376f56bb3001a0d485bcb4646d1e1a515b834e9a6775a93ccf4b0abbaf00457630fe4ad632a9fa280fad34fe86abc761ab
SSDEEP

384:ltWkq0O/6eYU3efFcGFgT+FZG2Y+z/S5z0vnU5A:KTCLU3+FcGFgTCGyvU5

Score

1^/10

Malware Config

Signatures

Files

tempagentfn.sys
.sys windows:10 windows x64 arch:x64

0023c7778cce36e2b58d08cd67288de7

Code Sign

ee:7e:59:0e:5d:68:29:dc:a8:c7:05:1d:52:56:13:d5
Certificate

Issuer

CN=Digicert,1.2.840.113549.1.9.1=#0c1564696769636572744074696d657374616d702e6363

Not Before

05/01/2023, 05:00

Not After

05/01/2028, 16:30

Subject

CN=Digicert,1.2.840.113549.1.9.1=#0c1564696769636572744074696d657374616d702e6363

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7e:97:f6:8d:4a:6f:43:29:43:5f:81:64:ba:d4:dd:52:a5:39:f5:0e:57:f2:58:39:ec:ed:00:b5:73:7c:4a:d5
Signer

Actual PE Digest

7e:97:f6:8d:4a:6f:43:29:43:5f:81:64:ba:d4:dd:52:a5:39:f5:0e:57:f2:58:39:ec:ed:00:b5:73:7c:4a:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\missy\source\repos\soardrv\x64\Release\soardrv.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
DbgPrintEx
KeInitializeEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
MmMapLockedPages
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetAttachedDeviceReference
IoGetDeviceObjectPointer
ObfDereferenceObject
RtlRandomEx
IoEnumerateDeviceObjectList
sscanf_s
swprintf
ObReferenceObjectByName
rand
IoDriverObjectType
tolower
strstr
MmCopyMemory
ZwQuerySystemInformation

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0023c7778cce36e2b58d08cd67288de7

Code Sign

ee:7e:59:0e:5d:68:29:dc:a8:c7:05:1d:52:56:13:d5Certificate

Extended Key Usages

Key Usages

7e:97:f6:8d:4a:6f:43:29:43:5f:81:64:ba:d4:dd:52:a5:39:f5:0e:57:f2:58:39:ec:ed:00:b5:73:7c:4a:d5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 12KB

.pdata Size: 512B - Virtual size: 444B

INIT Size: 1024B - Virtual size: 712B

ee:7e:59:0e:5d:68:29:dc:a8:c7:05:1d:52:56:13:d5
Certificate

7e:97:f6:8d:4a:6f:43:29:43:5f:81:64:ba:d4:dd:52:a5:39:f5:0e:57:f2:58:39:ec:ed:00:b5:73:7c:4a:d5
Signer

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 12KB

.pdata
Size: 512B - Virtual size: 444B

INIT
Size: 1024B - Virtual size: 712B