Release.rar
- SHA256 30fad7cd42b4365bedb5c6c246571148c87bc6224bc2fcb708ad7b946099713f
Password
awdawdawdawdawdawd
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Release.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
Release.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target Release.rar
- Size 1.5MB
- Sample260923-zddvbacd37
- SHA256 30fad7cd42b4365bedb5c6c246571148c87bc6224bc2fcb708ad7b946099713f
- MD5 9f4170f305e36e1a4be795b3717d4af1
- SHA1 fe7b801ac0b8edc45beabc26178d130f3bcfa429
- SHA512 7b59cc98449be9d3fdd396be7e6d08ee6a93a9364c94a38211beb5d6d6dc320302f20ba1e20adbda15e438e980834fdd933bd2b4433a07143fb9210ea8bcf6fa
- SSDEEP 49152:vJMxmdoviGqjYDrR/BcxqFzvU5ubTfdeKlu:ROvvinjY7D3djA
- TLSH T1F275337A1E2F96F24B966321B2708B33D510A6D8B82B4F9E5DA541DBC3AF0D5C0D7213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/M8l8l External cs2.exe unpack001/Release/dumped/mapper.exe - Untrusted Codesign Signers 3 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Release/M8l8l Driver cs2/M8l8lDrivercs2.sys unpack001/Release/M8l8lDrivercs2.sys unpack001/Release/dumped/driver.sys
File Explorer
-
Release.rar.rar 1.5MB
-
Release/M8l8l Driver cs2/M8l8lDrivercs2.sys.sys 19KB
-
Release/M8l8l External cs2.exe.exe 541KB
-
Release/M8l8l External cs2.pdb4.1MB
-
Release/M8l8lDrivercs2.cer778B
-
Release/M8l8lDrivercs2.pdb428KB
-
Release/M8l8lDrivercs2.sys.sys 19KB
-
Release/M8l8lDrivercs2.sys.i64874KB
-
Release/dumped/driver.sys.sys 20KB
-
Release/dumped/mapper.exe.exe 331KB
Release/M8l8l Driver cs2/M8l8lDrivercs2.sys
- IMPHASH 9895b9f51e868af696ec467d829319a9
- SHA256 ec46b3d34d7594bcc5f56f4b0e438f313180a2220651a1c389ac818f36634799
- MD5 b0049a456a39eeff348081ea109248aa
- SHA1 bc89b2a1ba8bed58a9187009f408d878b9903b8e
- SHA512 92d040b924fcb2b54598d24da99de326463add2ae7ba133757bb5b57bacc1f5764e044402a460f7a1892086599e0280f75a4fe1c344fbd7debbbd4deb061bbf5
- SSDEEP 192:6kMC71/701A4Nsmf/MRZJvb+CMhk/5zs1QAHq9GDDHfPGvVsvfvvaWVoV0kDDVSA:1A1A4NsmfETJvqCukUQAHq9GvGvVEXd0
- TLSH T19D925CD5B25A18EACE62953D825A0F27EB72B0011B22C5EF47B281280D57FF66C38947
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
d0:e7:0c:75:f3:fc:bb:73:b4:5b:78:f9:88:dd:ae:0c:38:ee:13:02:ad:67:ef:d9:9a:6e:35:21:74:72:77:04
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert PC\,134346175574103620
Chains
Sep 23, 2026
CN=WDKTestCert PC\,134346175574103620
Subject
CN=WDKTestCert PC\,134346175574103620
Serial Number
6e:6f:55:e6:a1:02:89:a2:4e:98:8b:da:f0:b9:8f:81
Issuer
CN=WDKTestCert PC\,134346175574103620
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 23, 2026 - Sep 23, 2036
Minor OS version
0
Major OS version
10
Entry point
10176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\PC\source\repos\M8l8l CSGO\x64\Release\M8l8lDrivercs2.pdb
ntoskrnl.exe
RtlInitUnicodeString
RtlEqualUnicodeString
KeDelayExecutionThread
KeQueryTimeIncrement
ExAllocatePool2
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwCreateKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
ZwCreateEvent
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQuerySystemInformation
ZwProtectVirtualMemory
MmCopyVirtualMemory
__C_specific_handler
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=35222,
count=31, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=261, version=35222,
count=5, id=259, version=35222,
count=5, id=260, version=35222,
count=1, id=261, version=36260,
count=1, id=258, version=36260,
Release/M8l8l External cs2.exe
- IMPHASH 3341e6a3da4951097a6aafd0d17477e0
- SHA256 3bcf32159ef468e3fa74d0f7bf4349ee39afe514e2ef529cefa9cf258e3dfb12
- MD5 28e8a3672d8560512733c0bac88e5ae9
- SHA1 ff6f90238d65efa6db1e565dfa4d72aecc0195c9
- SHA512 59f61e6130bef1dbc3e618647a1682880d9d5857b95e719b64ca97c0f3fa8661773cecdb42faa48b5fe91450268d10cfece3171b052b196b3bf988432f5b6423
- SSDEEP 12288:YEx0u02iMBEzh3veC3LSb/dBJD6MYiwnA19VE:lx0qBEF3mdBJEiwn
- TLSH T1FEC49E81B1F853F8D02BA17896D6F11FFA363458172055DBA3E405982FE73E0ABB7612
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
awdawdawdawdawdawd
Minor OS version
0
Major OS version
6
Entry point
439984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\PC\source\repos\M8l8l CSGO\x64\Release\M8l8l External cs2.pdb
d3d11
D3D11CreateDeviceAndSwapChain
user32
SetCursorPos
ReleaseCapture
GetClipboardData
SetClipboardData
CallWindowProcW
SetWindowLongPtrW
GetAsyncKeyState
DefWindowProcW
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
IsWindowUnicode
GetCursorPos
EmptyClipboard
CloseClipboard
OpenClipboard
GetClientRect
kernel32
WakeAllConditionVariable
SetUnhandledExceptionFilter
ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
InitializeSListHead
SleepConditionVariableSRW
AcquireSRWLockExclusive
Process32FirstW
Process32NextW
AllocConsole
SetConsoleTitleA
GetTickCount
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
IsDBCSLeadByte
GetProcAddress
FreeLibrary
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
shell32
ShellExecuteW
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_lock
_Mtx_unlock
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
_CxxThrowException
__std_exception_copy
__std_exception_destroy
strchr
__current_exception
memcpy
__std_terminate
memcmp
memchr
memset
memmove
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
ftell
__p__commode
_set_fmode
freopen_s
__acrt_iob_func
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vfprintf
fseek
fflush
fclose
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-string-l1-1-0
wcscpy_s
wcslen
strncmp
strlen
strcmp
_wcsicmp
strncpy
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_configure_narrow_argv
terminate
_initialize_narrow_environment
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_get_initial_narrow_environment
api-ms-win-crt-math-l1-1-0
powf
pow
cosf
fmodf
sinf
acosf
log
logf
atan2f
ceilf
sqrtf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
596B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35721,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=29, id=261, version=35721,
count=17, id=257, version=35222,
count=224, id=1, productName=Unmarked objects,
count=19, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
Release/M8l8l External cs2.pdb
- SHA256 e8064c576b14e45975af52667c55a95c4361a00873e96e0463d2cd2e22925fbd
- MD5 8f6680511dacf54368532e44f5f675df
- SHA1 832c703a340dd1a0c4be37907a8d26d0e545f046
- SHA512 4f75cc8a4283e9810e0a4a1e18e9df80fcd829277bdfd612c6fe91576b1041fe1c7fef5a849a5637d7af37cf548947139aa44fcde6e5d235fd47fdb2a6207637
- SSDEEP 49152:h7c8WQjAKz6PZJpsgJQGGkMFMDW93hkHkP+El3UXE4Hp95K8UDK5T8Rqe/THAHL7:9qNDW93hkHjA4B
- TLSH T1FC163BB2FA449D22D82B163DE2970B0C63E9DA159BEF7397850DF20D9DD5304CE1EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/M8l8lDrivercs2.cer
- SHA256 1dac8e30eb6bcab2dc4904d8ba4cf98e238865124a8a969627b8ff4658263b51
- MD5 021aa32deea37fc7a7069298fe083df2
- SHA1 e0b697e984802ac291d23b980d85dd333e324634
- SHA512 49096914787b4a1edc1e81fde9d108f9f6a05fd0acd9b4bf24faf7ef9dafb5914a1585fb9ad113ee922dc4603533fe03519a7bbd8a69dd02a3edbd880312c689
- TLSH T13E01BA6C57347505D4425C0A337D8F323E72514006D425E7B5AE0650378C5F13424C69
- MD5 SHA1 SHA512 TLSH
Release/M8l8lDrivercs2.pdb
- SHA256 5b228c2592786fc3e2524bfa71dcca25430f354e9b8febd88803285f73c4e41b
- MD5 2ba53749cb0fb8ad295a1034f9e8b6c6
- SHA1 6be479437047af296252e3937ff2321f4f5cac6a
- SHA512 c75feb1cd5f13b563c42f5c11ccc010118a723b86e5a2898eeabbb9c39a9719f71b86173e061bbe37aaa85b601f1dd9554d619d677ba1e50e2ea9371d8a5f3a2
- SSDEEP 6144:ISCXzw4MA2McueHXWsLsaJiNkCcp/IaqElK7JRvYxXIjaaDUpPIT:InQknjr
- TLSH T1C7945A7DE7289DB2C46F063D24930F0D2198CFA2DA8A8A535A04F75A8CF776097ED741
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/M8l8lDrivercs2.sys
- IMPHASH 9895b9f51e868af696ec467d829319a9
- SHA256 ec46b3d34d7594bcc5f56f4b0e438f313180a2220651a1c389ac818f36634799
- MD5 b0049a456a39eeff348081ea109248aa
- SHA1 bc89b2a1ba8bed58a9187009f408d878b9903b8e
- SHA512 92d040b924fcb2b54598d24da99de326463add2ae7ba133757bb5b57bacc1f5764e044402a460f7a1892086599e0280f75a4fe1c344fbd7debbbd4deb061bbf5
- SSDEEP 192:6kMC71/701A4Nsmf/MRZJvb+CMhk/5zs1QAHq9GDDHfPGvVsvfvvaWVoV0kDDVSA:1A1A4NsmfETJvqCukUQAHq9GvGvVEXd0
- TLSH T19D925CD5B25A18EACE62953D825A0F27EB72B0011B22C5EF47B281280D57FF66C38947
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
d0:e7:0c:75:f3:fc:bb:73:b4:5b:78:f9:88:dd:ae:0c:38:ee:13:02:ad:67:ef:d9:9a:6e:35:21:74:72:77:04
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert PC\,134346175574103620
Chains
Sep 23, 2026
CN=WDKTestCert PC\,134346175574103620
Subject
CN=WDKTestCert PC\,134346175574103620
Serial Number
6e:6f:55:e6:a1:02:89:a2:4e:98:8b:da:f0:b9:8f:81
Issuer
CN=WDKTestCert PC\,134346175574103620
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 23, 2026 - Sep 23, 2036
Minor OS version
0
Major OS version
10
Entry point
10176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\PC\source\repos\M8l8l CSGO\x64\Release\M8l8lDrivercs2.pdb
ntoskrnl.exe
RtlInitUnicodeString
RtlEqualUnicodeString
KeDelayExecutionThread
KeQueryTimeIncrement
ExAllocatePool2
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwCreateKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
ZwCreateEvent
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQuerySystemInformation
ZwProtectVirtualMemory
MmCopyVirtualMemory
__C_specific_handler
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=35222,
count=31, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=261, version=35222,
count=5, id=259, version=35222,
count=5, id=260, version=35222,
count=1, id=261, version=36260,
count=1, id=258, version=36260,
Release/M8l8lDrivercs2.sys.i64
- SHA256 d630641c929965b1486c187e846b1282e430f81e07db5b0aee9b713f70da7819
- MD5 3c0e5d9105df4b102fd87e8dbeb85ea8
- SHA1 2aac8fc802f223fae778c231434304a3ea7bf730
- SHA512 2895dff3e9e4da2920428da9319aac4964db25631b4b905911e8816c1a48df4915dfcc890d41ab276be518b59dc3384038b5b0121235475e234ad238627fdb2e
- SSDEEP 6144:RYZOxzc7XDS93ZcxPpvN1MBWuRhg8YJXxFPMig/Pnmc:3aue1ytnmc
- TLSH T1A5150ABFFBC57B95C8DD073650F9C2112F70928B1906C3062DE0A64969EEBD207A275E
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/dumped/driver.sys
- SHA256 7fd66934483f6dd6b8d276108355d6ad778d6dcf1adfbef995280898ff4d6eda
- MD5 a591663292992be6db765a1f2ca8a489
- SHA1 cc6cb4e7f418d1aecfea9c2de836f1a123a3b6a5
- SHA512 a45ad123e0f580381615af74a21c58f91e7405b436fef88a0e1e8655c2f621197030336c140b0ee4fecd3d7dda7888bb815fefe3f5bf07f6f9ae479ce64350da
- SSDEEP 384:VINHIkPWe54BEZfc68fndpXSdXpGBbHX5Q3Dj83OdHdyRYLpT97fqBILZ5TJ:aNBWJO5c6edpidXpGx35QTY3kHdyWDLz
- TLSH T1AE920731A4DE6BA5CFA0903E5DDB574783B7B6C6171493DB42996AAF2323188E1FC310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7c:60:df:8d:12:29:1b:3b:4d:37:5a:4b:b4:dc:70:c0:66:35:8e:c0:e8:3e:01:26:ac:8f:32:ef:c8:2f:06:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert Rac0001\,133994072932386204
Chains
Sep 23, 2026
CN=WDKTestCert Rac0001\,133994072932386204
Subject
CN=WDKTestCert Rac0001\,133994072932386204
Serial Number
5b:7e:a9:e6:88:61:90:a0:44:7f:41:34:be:91:0a:06
Issuer
CN=WDKTestCert Rac0001\,133994072932386204
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2025 - Aug 11, 2035
Minor OS version
0
Major OS version
10
Entry point
4224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Rac0001\Desktop\timeless-everything\timeless-kernel V2\timeless-kernel\NO
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=33140,
count=1, id=260, version=33140,
count=1, id=259, version=35214,
count=2, id=261, version=35214,
count=1, id=258, version=35214,
Release/dumped/mapper.exe
- IMPHASH 079f3c6dbbcfa1985ae5ea500a8fdd67
- SHA256 8b3fea24ac83e67fa89b9cd27d7f4e9b2bfd15c798517316db5309c962a22fe1
- MD5 73561ed73268e075dfe52def27aa490b
- SHA1 20c744f1e89198d989cdb0dc767dff1db163095c
- SHA512 acb4d42c283cb3a1a86bacc77ad30980bd4890bac1006e6fc01aa8950a4b5ac0a0a419fddb834be0cad7b651f64404a5764325db380fbee8c6a4be77dede7231
- SSDEEP 6144:6j9LQYBM0691JKSnC7//p2a4DUph0lhSMXlBXBWnrWlswFG:OJh4k4gph0lhSMXliaSwF
- TLSH T10174AE16FB95A0F9E255C5B9C9A60A45FB733CCC434157CF13A889A12F63AD12E3FA01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
awdawdawdawdawdawd
Minor OS version
0
Major OS version
6
Entry point
115940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\d7\Downloads\ThePerfectMapper\ThePerfectMapper\x64\Release\ThePerfectMapper.pdb
kernel32
CloseHandle
GetProcAddress
GetCurrentProcessId
GetModuleHandleA
GetTempPathW
GetCurrentProcess
SetUnhandledExceptionFilter
FormatMessageA
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
VirtualFree
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
LocalFree
advapi32
RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
msvcp140
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Mbrtowc
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Lockit@std@@QEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
ntdll
NtQuerySystemInformation
RtlAdjustPrivilege
NtLoadDriver
NtUnloadDriver
RtlInitUnicodeString
dbghelp
SymSetOptions
SymSrvGetFileIndexInfo
UnDecorateSymbolName
SymInitialize
SymCleanup
winhttp
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
memset
memcpy
_CxxThrowException
__std_terminate
wcsstr
__std_exception_copy
__std_exception_destroy
memcmp
memmove
api-ms-win-crt-stdio-l1-1-0
fgetc
setvbuf
fclose
ungetc
fflush
fgetpos
fread
fputc
__p__commode
_get_stream_buffer_pointers
_set_fmode
fsetpos
fwrite
_fseeki64
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
abort
_seh_filter_exe
_exit
_set_app_type
_configure_narrow_argv
_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
__p___argc
__p___argv
_initterm_e
_invoke_watson
_cexit
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_c_exit
_register_thread_local_exe_atexit_callback
exit
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_wremove
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
_dclass
_dsign
_fdsign
_fdclass
_ldclass
__setusermatherr
_ldsign
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
Name
.text
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
203KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=38, id=261, version=35207,
count=6, id=257, version=35207,
count=11, id=257, version=33145,
count=243, id=1, productName=Unmarked objects,
count=5, id=265, version=35226,
count=1, id=255, version=35226,
count=1, id=258, version=35226,