WinRing0x64[.]sys | Triage™

Resubmissions

08/08/2026, 23:53

260808-3xbe3seq4w3

08/08/2026, 23:48

260808-3tvdsazzax3

Sharing

Copy URL Twitter E-mail

General

Target
WinRing0x64.sys
Size 14KB
Sample260808-3xbe3seq4w
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
WinRing0x64.sys

File Explorer

WinRing0x64.sys

.sys 14KB

WinRing0x64.sys

IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Chains

Jul 26, 2008

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Subject

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Serial Number

01:00:00:00:00:01:15:37:24:21:a8

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Revocation Status

Not revoked

Timespan

Sep 24, 2007 - Sep 24, 2008

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:00:f9:7f:aa:2e:1e

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 16, 2003 - Jan 27, 2014

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:1c:d6

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2014

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Serial Number

04:00:00:00:00:01:10:92:eb:82:95

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 5, 2007 - Jan 27, 2014

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:24:48

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 22, 2004 - Jan 27, 2014

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:0b:7f:6b:00:00:00:00:00:19

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

20488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb

Name

.text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WinRing0x64.sys

PE Signature issue

ntoskrnl.exe

hal

generic