3cb5f8f2426afbe99d9e25294d230bc7b10badf940b3999189e4fc1d257122f9

Sharing

Copy URL Twitter E-mail

General

Target

3cb5f8f2426afbe99d9e25294d230bc7b10badf940b3999189e4fc1d257122f9
Size

25KB
MD5

6ba0e3cd5741fa1819e655d75f79c63e
SHA1

39145f4a584a0e7e9fd196db2a498f920718b680
SHA256

3cb5f8f2426afbe99d9e25294d230bc7b10badf940b3999189e4fc1d257122f9
SHA512

d2223add71a55676ebf099ba1d55288770d78a3351c9432fb37f8af95bb15d240218145d5bb6f602ab119d44ccd5bfbdc276a6c540d7f26a54f5b410015560d5
SSDEEP

384:CZsN/FaTKqc2Ssr4mj28aIqIyrizoquzQqaTlEQj6OOlfk9hw:6sN/Mvc2lrLvahQqaTlEm6OOlfn

Score

1^/10

Malware Config

Signatures

Files

3cb5f8f2426afbe99d9e25294d230bc7b10badf940b3999189e4fc1d257122f9
.sys windows:10 windows x64 arch:x64

bc7917757af6816b12aa0cdf56d80f96

Code Sign

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:fa
Certificate

Issuer

CN=WDKTestCert dy\,133666952321935811

Not Before

29/07/2024, 02:53

Not After

29/07/2034, 00:00

Subject

CN=WDKTestCert dy\,133666952321935811

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

aa:b4:ea:ec:fd:dd:0a:11:2d:e5:c6:ca:28:a2:2b:b9:36:7a:a1:ff
Signer

Actual PE Digest

aa:b4:ea:ec:fd:dd:0a:11:2d:e5:c6:ca:28:a2:2b:b9:36:7a:a1:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\dy\Desktop\wdf\mf_driver_chr\mf_driver_3\x64\Release\UartMf.pdb

Imports

ntoskrnl.exe

DbgPrint
KeInsertQueueDpc
KeRemoveDeviceQueue
KeSetEvent
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoAcquireCancelSpinLock
IofCompleteRequest
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ExEventObjectType
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlCompareMemory
KeInitializeDpc
KeSynchronizeExecution
KeInitializeEvent
KeResetEvent
KeInitializeMutex
KeDelayExecutionThread
KeWaitForSingleObject
ExAllocatePool
ExAllocatePoolWithTag
ExFreePool
MmMapIoSpace
MmUnmapIoSpace
IoAttachDeviceToDeviceStack
IofCallDriver
IoConnectInterrupt
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoDisconnectInterrupt
IoGetDeviceProperty
ObfReferenceObject
swprintf
_itoa
KeBugCheckEx

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 822B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc7917757af6816b12aa0cdf56d80f96

Code Sign

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:faCertificate

Extended Key Usages

Key Usages

aa:b4:ea:ec:fd:dd:0a:11:2d:e5:c6:ca:28:a2:2b:b9:36:7a:a1:ffSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 822B

.pdata Size: 1024B - Virtual size: 636B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 228B

78:b3:e1:e8:c8:f3:77:af:41:e4:97:3f:f2:8a:0d:fa
Certificate

aa:b4:ea:ec:fd:dd:0a:11:2d:e5:c6:ca:28:a2:2b:b9:36:7a:a1:ff
Signer

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 822B

.pdata
Size: 1024B - Virtual size: 636B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 228B