ude-driver.zip
- SHA256 4cdc6cbbe9adef692fdea16ac3ec3879fd764f13840f8e92fde80d40ab8e64eb
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ude-driver.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ude-driver.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ude-driver.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ude-usermode.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
ude-usermode.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target ude-driver.zip
- Size 162KB
- Sample260621-phex3aes2x
- SHA256 4cdc6cbbe9adef692fdea16ac3ec3879fd764f13840f8e92fde80d40ab8e64eb
- MD5 dd1768cbb43ce59b3e841d3333426215
- SHA1 f76909bd69ed76e931dff9a6142427ff1734f457
- SHA512 2c332b02f2586744057f044220ac5bddeb41bd51ed444fc76102899da2c3dbf8b3f73064b99e1bc2bcf366702de8fa432ea756a82dbd5e075c79f85ca1d53048
- SSDEEP 3072:vBgR8k/rLGYJIdCHo8NALUKKI7TqtpfbQ4tYGlXeHf/Us:GR8kDmcoCUUnIXypDQ4tYN/j
- TLSH T1AFF312906CFD5DE200317439D35F94967B483EF8794CEA8CE306AA4B219F87533961CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ude-usermode.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/ude-driver.sys
File Explorer
-
ude-driver.zip.zip 162KB
-
ude-driver.sys.sys 98KB
-
ude-usermode.exe.exe 236KB
ude-driver.sys
- IMPHASH 5048461d588b632980daf0fe44b96fcc
- SHA256 ccb998375f2889d49f807395a6920fd31329bbe35d3c1d2b2e8e5f5095cf6608
- MD5 803ede271c40fb159e72aeb3dbdd7157
- SHA1 b985281bbae9a42fcdce5737005acafd15212f37
- SHA512 4dbf99c13c77795451f6838b3c4513be35b2668e409eb0647f7de76dde6d4246ec9e17a3d6999311c59c2c1490c1f96d51df41ca6228fc8d7971b45c961adbfa
- SSDEEP 1536:yVRAbGo+9UKPcQfKAri32Z4+ChCxSWHIxBwyKrmZYUJ+HS9iV:AybGDU5G++qCxDHIYPrRUJ+R
- TLSH T1BCA36C62E254A0F8C1BED175C4465427EBB2B459133667DF23B086993B537E0FA3E382
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ad:22:d8:f6:d3:12:84:35:e6:08:22:3c:90:f6:29:d3:7d:22:a9:f5:83:c1:53:b3:07:c9:29:13:be:e3:6e:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert lepro\,134256710042859622
Chains
Jun 19, 2026
CN=WDKTestCert lepro\,134256710042859622
Subject
CN=WDKTestCert lepro\,134256710042859622
Serial Number
4c:91:d3:73:69:57:ce:a8:40:cd:70:d5:38:7b:25:2b
Issuer
CN=WDKTestCert lepro\,134256710042859622
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 11, 2026 - Jun 11, 2036
Minor OS version
0
Major OS version
10
Entry point
14528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\ude\builds\ude-driver.pdb
ntoskrnl.exe
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlFreeAnsiString
DbgPrintEx
RtlCompareMemory
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeIpiGenericCall
KeRegisterNmiCallback
KeDeregisterNmiCallback
KeQueryActiveProcessorCountEx
ExAllocatePoolWithTag
ExFreePoolWithTag
ExAcquirePushLockExclusiveEx
ExAcquirePushLockSharedEx
ExReleasePushLockExclusiveEx
ExReleasePushLockSharedEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetAttachedDeviceReference
IoGetDeviceObjectPointer
IoGetStackLimits
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
ObGetObjectSecurity
ObReleaseObjectSecurity
ZwCreateFile
RtlInitUnicodeString
ZwReadFile
ZwClose
ZwOpenSection
ZwOpenKey
ZwQueryValueKey
RtlWalkFrameChain
RtlEqualString
MmGetPhysicalMemoryRanges
MmGetPhysicalAddress
MmCopyMemory
MmGetVirtualForPhysical
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessExitStatus
PsGetProcessId
_vsnprintf
_vsnwprintf
ZwQuerySystemInformation
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PsGetThreadProcess
PsGetProcessSessionId
PsGetProcessImageFileName
ObReferenceObjectByName
ZwOpenDirectoryObject
ZwQueryDirectoryObject
__chkstk
PsInitialSystemProcess
IoDriverObjectType
IoDeviceObjectType
ZwQueryInformationFile
RtlInitAnsiString
hal
KeStallExecutionProcessor
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=33145,
count=70, id=1, productName=Unmarked objects,
count=5, id=259, version=33145,
count=7, id=260, version=33145,
count=1, id=261, version=35226,
count=1, id=258, version=35226,
ude-usermode.exe
- IMPHASH ba51b48b2e41ade5265773547e1e5e5d
- SHA256 f06c9db65691f55df0d78f3a53edd5bc0d187e1edf7a2c3dbd6e736d324947a5
- MD5 696ba267524ee9b4089d483b8053e4c2
- SHA1 f28ad8e8eaf34556e808c070c0c933be4f7d98ff
- SHA512 aa5f6412dae6c86c17b8d23f231a5ca6bf85e3ecb0e28e06b65e00955e17b1d909742a38c701196404d7371a022f1a078f3010ed2d79cefd4b3f7e9f27ec04d2
- SSDEEP 6144:jr8UAhSDRvpnuSWO09wSB8cz3XZFOk39bW2:AYD/ne9z3pFfb
- TLSH T1B4347C17766518B9E96BD478CE939503EA333C454761EADF03E148A51F33EF0AA3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
144628
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\ude\builds\ude-usermode.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d2d1
ord1
dwrite
DWriteCreateFactory
kernel32
FindClose
WaitForSingleObject
CreateFileW
GetCurrentDirectoryA
GetModuleHandleA
Sleep
GetConsoleMode
DeleteFileA
CloseHandle
GetWindowsDirectoryW
GetProcAddress
DeleteCriticalSection
CreateProcessW
GetExitCodeProcess
LoadLibraryExW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
VirtualAlloc
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WideCharToMultiByte
InitializeCriticalSectionEx
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFileAttributesExW
DeviceIoControl
SetConsoleMode
ExpandEnvironmentStringsW
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
VirtualFree
FindFirstFileA
SetConsoleCtrlHandler
GetModuleHandleW
GetLastError
GetModuleFileNameW
GetTempPathW
GetCurrentThreadId
WakeAllConditionVariable
UnhandledExceptionFilter
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FormatMessageA
InitializeSListHead
OutputDebugStringW
GetLocaleInfoEx
LocalFree
user32
DestroyWindow
SetProcessDpiAwarenessContext
CreateWindowExW
GetSystemMetrics
UnregisterClassW
GetWindowLongPtrW
RegisterClassExW
ShowWindow
DefWindowProcW
GetAsyncKeyState
ScreenToClient
PostMessageW
UpdateWindow
PostQuitMessage
SetWindowLongPtrW
LoadCursorW
TranslateMessage
SetLayeredWindowAttributes
PeekMessageW
DispatchMessageW
GetCursorPos
advapi32
AdjustTokenPrivileges
RegCloseKey
RegEnumKeyW
RegOpenKeyA
RegDeleteKeyW
LookupPrivilegeValueA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
OpenProcessToken
RegOpenKeyExW
RegCreateKeyW
RegOpenKeyW
RegQueryValueExW
GetTokenInformation
shell32
ShellExecuteExA
ole32
CoInitializeEx
StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
msvcp140
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1_Lockit@std@@QEAA@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
_Mtx_unlock
_Thrd_join
_Thrd_id
_Cnd_wait
_Cnd_do_broadcast_at_thread_exit
_Mtx_lock
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_signal
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileW
URLDownloadToFileA
ntdll
RtlLookupFunctionEntry
NtQuerySystemInformation
RtlVirtualUnwind
NtClose
RtlCaptureContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
memcpy
__std_exception_destroy
memcmp
__C_specific_handler
__current_exception_context
memset
wcsrchr
wcsstr
__std_terminate
__std_exception_copy
memmove
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
_invoke_watson
__p___argc
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_set_app_type
_get_initial_wide_environment
_seh_filter_exe
terminate
abort
_cexit
_crt_atexit
_register_onexit_function
_beginthreadex
_initialize_onexit_table
_initialize_wide_environment
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
fputc
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
getchar
ungetc
__acrt_iob_func
setvbuf
fgetws
fgetpos
fwrite
__stdio_common_vfprintf
fgetc
__stdio_common_vsprintf_s
fflush
_wfopen_s
__stdio_common_vfwprintf
fputws
fclose
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-string-l1-1-0
tolower
wcscpy_s
strncpy_s
_stricmp
wcsncmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cosf
fmodf
__setusermatherr
sinf
ceilf
sqrtf
Name
.text
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=6, id=257, version=35207,
count=1, id=260, version=33145,
count=25, id=257, version=33145,
count=299, id=1, productName=Unmarked objects,
count=38, id=261, version=35207,
count=11, id=260, version=35207,
count=6, id=265, version=35226,
count=1, id=255, version=35226,
count=1, id=258, version=35226,