signed_ud[.]sys

Sharing

Copy URL

Twitter E-mail

General

Target

signed_ud.sys
Size

24KB
MD5

699b4c2d77cb88d3c2276985a812d769
SHA1

fb88e45a297dd85188da299bf2499e7154af7b5b
SHA256

bb77098fe313349e79692a494e8a83a573507a8541020980ba61331d6b9bcc19
SHA512

a832ff7a5a413607f66ee96330107313f221948cd018d736116fed2a87fade36d7729245a66a218f673a4443b8be63687b9e2f96eefff53c833540918e63795a
SSDEEP

384:5PywvyzNmAMlFnOc9Ma2Wb/wfT3iEx7bLDUXGF7Y:5qwvopMDOc9MYi3iUbLDUX1

Score

1^/10

Malware Config

Signatures

Files

signed_ud.sys
.sys windows:10 windows x64 arch:x64

9cd3a2254af2c5c16a99addca383bf7f

Code Sign

2d:5b:c3:f1:75:68:2b:ab:4b:df:df:82:2a:d1:9f:6d
Certificate

Issuer

CN=DigiCert Inc.

Not Before

06-09-2024 21:24

Not After

06-09-2054 21:24

Subject

CN=DigiCert Inc.

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

07:f1:41:db:86:a5:a6:fc:33:35:01:f0:1c:a2:6c:dd
Certificate

Issuer

CN=DigiCert Inc.

Not Before

06-09-2024 21:24

Not After

06-09-2054 21:24

Subject

CN=MicrosoftOneDrive

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15-01-2024 00:00

Not After

14-04-2035 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22-03-2021 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:65:e3:00:2e:b3:6a:54:97:05:23:74:d0:a1:a5:43:da:fb:5c:1c
Signer

Actual PE Digest

e3:65:e3:00:2e:b3:6a:54:97:05:23:74:d0:a1:a5:43:da:fb:5c:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

MmIsAddressValid
ExAllocatePool
RtlAnsiStringToUnicodeString
ZwQuerySystemInformation
RtlEqualUnicodeString
RtlRandomEx
ObfDereferenceObject
RtlFreeUnicodeString
RtlInitUnicodeString
MmGetPhysicalAddress
strcmp
IoGetDeviceObjectPointer
RtlInitAnsiString
MmGetSystemRoutineAddress
ExFreePoolWithTag
ObReferenceObjectByName
ZwTerminateProcess
MmMapLockedPagesSpecifyCache
IofCompleteRequest
MmAllocateContiguousMemory
IoDriverObjectType
ZwOpenProcess

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9cd3a2254af2c5c16a99addca383bf7f

Code Sign

2d:5b:c3:f1:75:68:2b:ab:4b:df:df:82:2a:d1:9f:6dCertificate

Key Usages

07:f1:41:db:86:a5:a6:fc:33:35:01:f0:1c:a2:6c:ddCertificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

e3:65:e3:00:2e:b3:6a:54:97:05:23:74:d0:a1:a5:43:da:fb:5c:1cSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 1024B - Virtual size: 828B

.data Size: 10KB - Virtual size: 9KB

.pdata Size: 512B - Virtual size: 264B

INIT Size: 1024B - Virtual size: 746B

2d:5b:c3:f1:75:68:2b:ab:4b:df:df:82:2a:d1:9f:6d
Certificate

07:f1:41:db:86:a5:a6:fc:33:35:01:f0:1c:a2:6c:dd
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

e3:65:e3:00:2e:b3:6a:54:97:05:23:74:d0:a1:a5:43:da:fb:5c:1c
Signer

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 1024B - Virtual size: 828B

.data
Size: 10KB - Virtual size: 9KB

.pdata
Size: 512B - Virtual size: 264B

INIT
Size: 1024B - Virtual size: 746B