driver[.]sys[.]disabled

Resubmissions

12/09/2026, 13:06

260912-qcbtwsxepe

12/09/2026, 12:33

260912-pq86wahl2t3

Sharing

Copy URL Twitter E-mail

General

Target
driver.sys.disabled
Size 507.7MB
Sample260912-qcbtwsxepe
SHA256 65e4c31c47b42f69817e8440e17129db52dc7d69632b768fa52b61fb6306bc97
MD5 fc887ec4b65f49108d3cf63de672f96f
SHA1 ea9cfb962e9c5c18c51dc238dbf271e2dfadd3f6
SHA512 f4275c084ba98b2bb3b8c879aa9572c316bc346fa4d957693813badc7b595e1c44dfc2422442570fc23540e4523ca1d592c5db7d208c2225cf8f0d5f45c3f7f2
SSDEEP 98304:p49Vgg8kc7lvaYwYAnulnBEs6w3J1W/n87Ibg6AT+LDRHDQwO0Mkj:p49+g8XAYKnmBFXJk87IFVREZPkj
TLSH
T19E4900C54895C1FCBF4B27F0D54536CAEA94F11609A8D4E5318F3B81BB61BB880ADB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
driver.sys.disabled

File Explorer

driver.sys.disabled

.sys 507.7MB

driver.sys.disabled

IMPHASH 150fbee90be704eec068ddc109013471
SHA256 65e4c31c47b42f69817e8440e17129db52dc7d69632b768fa52b61fb6306bc97
MD5 fc887ec4b65f49108d3cf63de672f96f
SHA1 ea9cfb962e9c5c18c51dc238dbf271e2dfadd3f6
SHA512 f4275c084ba98b2bb3b8c879aa9572c316bc346fa4d957693813badc7b595e1c44dfc2422442570fc23540e4523ca1d592c5db7d208c2225cf8f0d5f45c3f7f2
SSDEEP 98304:p49Vgg8kc7lvaYwYAnulnBEs6w3J1W/n87Ibg6AT+LDRHDQwO0Mkj:p49+g8XAYKnmBFXJk87IFVREZPkj
TLSH
T19E4900C54895C1FCBF4B27F0D54536CAEA94F11609A8D4E5318F3B81BB61BB880ADB63
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4029640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ndis.sys

NdisMSetMiniportAttributes NdisReadNetworkAddress

netio.sys

WskReleaseProviderNPI WskDeregister WskCaptureProviderNPI WskRegister

ntoskrnl.exe

IofCompleteRequest ObfDereferenceObject __C_specific_handler RtlInitUnicodeString KeDelayExecutionThread ExAllocatePoolWithTag ExFreePoolWithTag MmMapLockedPagesSpecifyCache IoGetDeviceObjectPointer ObReferenceObjectByName IoDriverObjectType KeLowerIrql KfRaiseIrql ExAllocatePool MmMapIoSpace MmUnmapIoSpace MmGetPhysicalAddress __chkstk RtlCompareMemory MmCopyMemory MmIsAddressValid KeGetCurrentIrql IoGetCurrentProcess IoIs32bitProcess PsGetProcessImageFileName MmCopyVirtualMemory strnlen MmAllocateContiguousMemory _strnicmp DbgPrint ZwOpenKey ZwQueryValueKey ZwSetValueKey ZwQuerySystemInformation strlen RtlGetVersion KeInitializeEvent KeSetEvent KeWaitForSingleObject IoAllocateIrp IoFreeIrp wcslen _stricmp RtlQueryRegistryValues MmGetSystemRoutineAddress RtlWriteRegistryValue strncmp DbgPrintEx memchr PsInitialSystemProcess KeBugCheckEx KeResetEvent MmBuildMdlForNonPagedPool IoAllocateMdl IoFreeMdl IoReuseIrp RtlInitAnsiString RtlAnsiStringToUnicodeString RtlUnicodeStringToAnsiString RtlFreeUnicodeString RtlFreeAnsiString ZwClose MmFreeContiguousMemory ExAllocatePool NtQuerySystemInformation ExFreePoolWithTag IoAllocateMdl MmProbeAndLockPages MmMapLockedPagesSpecifyCache MmUnlockPages IoFreeMdl KeQueryActiveProcessors KeSetSystemAffinityThread KeRevertToUserAffinityThread DbgPrint

hal

KeQueryPerformanceCounter

Name

.text

Size

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.FD"

Size

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.UPf

Size

1024B

Virtual Size

872B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.@|2

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

driver.sys.disabled

ndis.sys

netio.sys

ntoskrnl.exe

hal

generic