5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634[.]sys

General

Target
5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634.sys
Size 37KB
Sample260922-yadjpsea24
SHA256 5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634
MD5 b00bfbdc152bc2e3f19336e340d7a0a2
SHA1 ab87ef0f0e9d5fa5d1553c0e9623935bc0a376c8
SHA512 2655370c32dc456177dee272edf7408a9a11819f4e26679a5ce766ff04f036fe0e4f174a45677cfcbcca33ba3dcb85c7c576bc7766be9b726fc45582f1b2cdae
SSDEEP 768:My2ZKY0j23v1lnJmk7h1QMzdibwWDeKEI3iFl9zb:yrDNlnrhDzkbl2IK3zb
TLSH
T1B8038D52A6A414C4EAAEE9B0C170DE27E9B5B14A572196CF03B4CDA40F733D0E63D35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634.sys

.sys 37KB

5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634.sys

IMPHASH 83c8dab35f8fbef03d96e67503236ba1
SHA256 5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634
MD5 b00bfbdc152bc2e3f19336e340d7a0a2
SHA1 ab87ef0f0e9d5fa5d1553c0e9623935bc0a376c8
SHA512 2655370c32dc456177dee272edf7408a9a11819f4e26679a5ce766ff04f036fe0e4f174a45677cfcbcca33ba3dcb85c7c576bc7766be9b726fc45582f1b2cdae
SSDEEP 768:My2ZKY0j23v1lnJmk7h1QMzdibwWDeKEI3iFl9zb:yrDNlnrhDzkbl2IK3zb
TLSH
T1B8038D52A6A414C4EAAEE9B0C170DE27E9B5B14A572196CF03B4CDA40F733D0E63D35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

20:2f:75:01:db:bd:cd:85:9b:02:11:ab:54:f3:40:72:3d:00:5b:ec:ce:49:9c:a1:b3:d8:46:9e:73:52:98:48

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 13, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6d:aa:07:2f:95:82:18:c9:e3:00:00:00:00:00:6d

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 10, 2024 - Oct 8, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ee:05:d3:02:30:b2:9a:9d:a7:00:01:00:00:01:ee

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

19272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fwpkclnt.sys

FwpsApplyModifiedLayerData0 FwpsRedirectHandleCreate0 FwpsAcquireWritableLayerDataPointer0 FwpsQueryConnectionRedirectState0 FwpsReleaseClassifyHandle0 FwpsAcquireClassifyHandle0 FwpsCalloutRegister2

ntoskrnl.exe

RtlInitUnicodeString IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice ExFreePoolWithTag ObfDereferenceObject ZwCreateFile ZwQueryInformationFile ZwClose PsLookupProcessByProcessId PsReferenceProcessFilePointer RtlCompareMemory KeInitializeSpinLock KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock PsCreateSystemThread ZwOpenProcess ZwWaitForSingleObject RtlIpv4AddressToStringA IoGetCurrentProcess PsGetProcessId PsProcessType PsSetCreateProcessNotifyRoutine KeStackAttachProcess KeUnstackDetachProcess PsGetProcessWow64Process PsGetProcessImageFileName PsGetProcessPeb RtlInitAnsiString RtlAnsiStringToUnicodeString RtlFreeUnicodeString ExAllocatePool _vsnprintf _vsnwprintf KeEnterCriticalRegion KeLeaveCriticalRegion ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExAllocatePoolWithTag ObReferenceObjectByHandle ZwSetInformationFile ZwReadFile ZwWriteFile IoFileObjectType ZwTerminateProcess MmGetSystemRoutineAddress __C_specific_handler KeInitializeEvent KeWaitForSingleObject KeQueryTimeIncrement RtlRandomEx RtlGetVersion KeBugCheckEx RtlCopyUnicodeString _wcslwr wcsstr ExSystemTimeToLocalTime RtlTimeToTimeFields

wdfldr.sys

WdfVersionUnbind WdfVersionBindClass WdfVersionUnbindClass WdfVersionBind

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5316e27123000ba8d68e3bb74474c97f2b6032c7862568e30a89c0e8d2660634.sys

fwpkclnt.sys

ntoskrnl.exe

wdfldr.sys

generic