100Fi[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

100Fi.sys
Size

10KB
MD5

1477a776bed0ef17370b4963c285b0ce
SHA1

75f3f75c148f51e2200c5edc8a5951f40956b8b1
SHA256

2d9ce95cb4c88da66fe2bac6ec85c742b2e3cbf7ea9d4e8e06a2cf19f681b6c1
SHA512

87d0e08dfafad4391371ce95cf3b06bbe1c102e55ab78968dfe193551bdfb27089128a58e3d7bbe4212b7a8a247d8f6dcffb6d5e26ac1f8d610b3320bfa4fd77
SSDEEP

192:e0WPAQb7sQSYc4EVpPIKfhignDiG1g2MvqTEeTC5/iwnc:uXbIR54SpwKThECTEqs/iwnc

Score

1^/10

Malware Config

Signatures

Files

100Fi.sys
.sys windows:10 windows x64 arch:x64

410b48edaf470cbb2b101861e4c35b6b

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

10/11/2021, 00:00

Not After

09/11/2024, 23:59

Subject

CN=Hangil IT Co.\, Ltd,O=Hangil IT Co.\, Ltd,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:01:73:11:20:a7:42:1a:02:f8:bf:e3:b7:9a:02:f9:03:93:2e:08
Signer

Actual PE Digest

15:01:73:11:20:a7:42:1a:02:f8:bf:e3:b7:9a:02:f9:03:93:2e:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\xxxxx\xxxxxxxx\xxxxxxx\xxxxxxxxxxxxxx\xxxxxx\xxxxxx\xxxxx\xxx\xxxxxxx.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
ObfDereferenceObject
IoEnumerateDeviceObjectList
ObReferenceObjectByName
IoDriverObjectType
strstr
ZwQuerySystemInformation

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 342B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

410b48edaf470cbb2b101861e4c35b6b

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

15:01:73:11:20:a7:42:1a:02:f8:bf:e3:b7:9a:02:f9:03:93:2e:08Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1024B - Virtual size: 700B

.pdata Size: 512B - Virtual size: 108B

INIT Size: 512B - Virtual size: 342B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

15:01:73:11:20:a7:42:1a:02:f8:bf:e3:b7:9a:02:f9:03:93:2e:08
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 700B

.pdata
Size: 512B - Virtual size: 108B

INIT
Size: 512B - Virtual size: 342B