signed[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

signed.sys
Size

24KB
MD5

2f4e8e112f4ba3a590b7d82ae1560408
SHA1

1147d3e95752a48e5d9c48fb9f2da818acbe93a5
SHA256

938737343419255ebcf31b29a33e9af083535c0b12f72ab7eeafc6d63dd6ab8b
SHA512

3dcf49d4cd2b2f3ef5e95eb795aa9dd740f424b0e2789d7fe35b0cd2f7f9db37f3ebcdc7ae8a9f22071d5119cc2a6b6c8df35f9c6fffd38d72abddf6355de0ad
SSDEEP

384:HztVRdFf06hAAq5/7kR5r72Wb/wfT3iEx7bLDUNXP3:HzjRdtDr/i3iUbLDUNX/

Score

1^/10

Malware Config

Signatures

Files

signed.sys
.sys windows:10 windows x64 arch:x64

df552bc149e9cfef3db42fe67d0113d2

Code Sign

1c:58:b2:bd:30:b4:68:b7:49:a0:52:9a:16:9a:cb:0a
Certificate

Issuer

CN=DigiCert Inc.

Not Before

26/08/2024, 00:53

Not After

26/08/2054, 00:53

Subject

CN=DigiCert Inc.

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:de:74:8e:2a:cc:1b:44:fb:17:67:bb:72:fb:c9:13
Certificate

Issuer

CN=DigiCert Inc.

Not Before

26/08/2024, 00:53

Not After

26/08/2054, 00:53

Subject

CN=Microsoft Windows Early Launch Anti-malware Publisher

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:b8:93:72:7f:3c:5d:ac:c5:46:95:b8:44:5c:1a:3b:b4:38:70:54
Signer

Actual PE Digest

c5:b8:93:72:7f:3c:5d:ac:c5:46:95:b8:44:5c:1a:3b:b4:38:70:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Matty\Desktop\KMDF Driver1\x64\Release\KMDFDriver1.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySystemInformation
RtlInitString
RtlInitUnicodeString
ExAllocatePool
IoGetDeviceObjectPointer
DbgPrintEx
RtlGetVersion
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeQueryUnbiasedInterruptTime
MmMapIoSpace
MmUnmapIoSpace
isupper
islower
isdigit
strstr
KeQueryTimeIncrement
RtlRandomEx
_vsnwprintf

hal

KeQueryPerformanceCounter

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df552bc149e9cfef3db42fe67d0113d2

Code Sign

1c:58:b2:bd:30:b4:68:b7:49:a0:52:9a:16:9a:cb:0aCertificate

Key Usages

61:de:74:8e:2a:cc:1b:44:fb:17:67:bb:72:fb:c9:13Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

c5:b8:93:72:7f:3c:5d:ac:c5:46:95:b8:44:5c:1a:3b:b4:38:70:54Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 112B

.pdata Size: 512B - Virtual size: 324B

INIT Size: 1024B - Virtual size: 700B

.reloc Size: 512B - Virtual size: 36B

1c:58:b2:bd:30:b4:68:b7:49:a0:52:9a:16:9a:cb:0a
Certificate

61:de:74:8e:2a:cc:1b:44:fb:17:67:bb:72:fb:c9:13
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

c5:b8:93:72:7f:3c:5d:ac:c5:46:95:b8:44:5c:1a:3b:b4:38:70:54
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 112B

.pdata
Size: 512B - Virtual size: 324B

INIT
Size: 1024B - Virtual size: 700B

.reloc
Size: 512B - Virtual size: 36B