acd17afbb8bc49a55d9e67188b9174092e73ead81f77b7263a00ccec3a767852

Sharing

Copy URL Twitter E-mail

General

Target

acd17afbb8bc49a55d9e67188b9174092e73ead81f77b7263a00ccec3a767852
Size

12KB
MD5

f67fb21d24e49a7b6b684683da9ddd6d
SHA1

e93e187947654ddb94d7b6f90e9455471d9f5bb2
SHA256

acd17afbb8bc49a55d9e67188b9174092e73ead81f77b7263a00ccec3a767852
SHA512

8d8a6c843cdbb67fbcf26533989fa072e7b8abdca1c7b0e3eeee088458f55176f527214922bfbd16a3b1cb306b3a9f5c94b7c1bfdac0f8f9b6037717b15322d2
SSDEEP

192:+suavzr7/RwIWZzyYIsNj8291b6U2I5a0vLILB2dNMb0yT9KHDRNNulN39t:+WvzvuIWhyYXB5zcYad

Score

1^/10

Malware Config

Signatures

Files

acd17afbb8bc49a55d9e67188b9174092e73ead81f77b7263a00ccec3a767852
.sys windows:10 windows x64 arch:x64

5cc8dbf9aa367b0d30c1a975a2a7f020

Code Sign

7e:aa:64:f7:b4:86:45:99:47:9b:46:08:bb:db:c3:1f
Certificate

Issuer

CN=WDKTestCert Asus\,133568602556667060

Not Before

06/04/2024, 06:57

Not After

06/04/2034, 00:00

Subject

CN=WDKTestCert Asus\,133568602556667060

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

a6:94:53:dd:91:01:26:05:9b:81:70:3d:c6:93:9b:9c:06:24:d4:1e:6c:64:42:2d:ac:40:ea:db:cc:02:2f:d5
Signer

Actual PE Digest

a6:94:53:dd:91:01:26:05:9b:81:70:3d:c6:93:9b:9c:06:24:d4:1e:6c:64:42:2d:ac:40:ea:db:cc:02:2f:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\VS Studio Repo\KDrawing2\x64\Release\KDrawing2.pdb

Imports

ntoskrnl.exe

DbgPrintEx
KeInitializeDpc
KeDelayExecutionThread
KeInitializeTimer
KeSetTimer
ExAllocatePool2
ExFreePool2
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoGetCurrentProcess
ZwClose
KeStackAttachProcess
KeUnstackDetachProcess
PsIsThreadTerminating
PsLookupThreadByThreadId
PsGetThreadProcess
ZwQuerySystemInformation
RtlFindExportedRoutineByName
__C_specific_handler
strcmp

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5cc8dbf9aa367b0d30c1a975a2a7f020

Code Sign

7e:aa:64:f7:b4:86:45:99:47:9b:46:08:bb:db:c3:1fCertificate

Extended Key Usages

Key Usages

a6:94:53:dd:91:01:26:05:9b:81:70:3d:c6:93:9b:9c:06:24:d4:1e:6c:64:42:2d:ac:40:ea:db:cc:02:2f:d5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 384B

.pdata Size: 512B - Virtual size: 156B

INIT Size: 1024B - Virtual size: 674B

.reloc Size: 512B - Virtual size: 36B

7e:aa:64:f7:b4:86:45:99:47:9b:46:08:bb:db:c3:1f
Certificate

a6:94:53:dd:91:01:26:05:9b:81:70:3d:c6:93:9b:9c:06:24:d4:1e:6c:64:42:2d:ac:40:ea:db:cc:02:2f:d5
Signer

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 384B

.pdata
Size: 512B - Virtual size: 156B

INIT
Size: 1024B - Virtual size: 674B

.reloc
Size: 512B - Virtual size: 36B