driver[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

driver.sys
Size

9KB
MD5

f044fc455d41d05528c13ff95b94cab6
SHA1

b85b66826bd2f69fa3cde012afd53c81578728bb
SHA256

8043d0e6607ecb35dca6032fb5f7ddfd8c9e28a375c8d9213a5224f495131df3
SHA512

e96bc552d200c2163622d09e9052cac73f441b145ea44a25d8b2377dc5d973a9ff6afab3130d48140e7d17bf9fd6756026a88cda546224d552b1cc81350e8ffb
SSDEEP

96:x/B6UlWzroo9FLpt3P7LW+SHWj7J65Cb54BL5vQfdaYnrEhGfl8ewsPcne0:xfWPR9FLpt3zLW+YcY5o4TYr6i88P+

Score

1^/10

Malware Config

Signatures

Files

driver.sys
.sys windows:10 windows x64 arch:x64

0b28e4c4e82f3157deec32c39e89d4e7

Code Sign

73:9a:41:ad:ac:f1:1b:b3:4f:a2:d8:cd:e4:cd:ad:70
Certificate

Issuer

CN=WDKTestCert kcxac\,132893862668093765

Not Before

15/02/2022, 08:11

Not After

15/02/2032, 00:00

Subject

CN=WDKTestCert kcxac\,132893862668093765

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

a8:8b:56:e7:95:21:5b:77:b1:f0:df:3b:be:6b:96:e2:43:fd:bf:71
Signer

Actual PE Digest

a8:8b:56:e7:95:21:5b:77:b1:f0:df:3b:be:6b:96:e2:43:fd:bf:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\kcxac\Documents\external-warzone-cheat-master\x64\Release\modern_warfare_driver.pdb

Imports

ntoskrnl.exe

RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlFreeUnicodeString
DbgPrintEx
ExAllocatePoolWithTag
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
PsLookupProcessByProcessId
RtlFindExportedRoutineByName
ZwQuerySystemInformation
PsGetProcessPeb
PsGetProcessSectionBaseAddress
MmCopyVirtualMemory

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b28e4c4e82f3157deec32c39e89d4e7

Code Sign

73:9a:41:ad:ac:f1:1b:b3:4f:a2:d8:cd:e4:cd:ad:70Certificate

Extended Key Usages

Key Usages

a8:8b:56:e7:95:21:5b:77:b1:f0:df:3b:be:6b:96:e2:43:fd:bf:71Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 16B

.pdata Size: 512B - Virtual size: 132B

INIT Size: 1024B - Virtual size: 724B

.reloc Size: 512B - Virtual size: 20B

73:9a:41:ad:ac:f1:1b:b3:4f:a2:d8:cd:e4:cd:ad:70
Certificate

a8:8b:56:e7:95:21:5b:77:b1:f0:df:3b:be:6b:96:e2:43:fd:bf:71
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 16B

.pdata
Size: 512B - Virtual size: 132B

INIT
Size: 1024B - Virtual size: 724B

.reloc
Size: 512B - Virtual size: 20B