dreamspoofer.zip
- SHA256 ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e
Behavioral task
behavioral1
Sample
dreamspoofer/resources/dreamCleaner.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
dreamspoofer/resources/dreamCleaner.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
dreamspoofer/resources/udmapper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
dreamspoofer/resources/udmapper.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target dreamspoofer.zip
- Size 7.9MB
- Sample261102-28lvhszy3p
- SHA256 ae3ec63290a5b41c097c00b5904d024f00a1ed8dca921e2d0cc965808688ff6e
- MD5 34934994770750cfda9e7a49795b931f
- SHA1 04da59bee72b155b2b1c36f56314b91bdaab7c8d
- SHA512 3fcaead99da7134540197d55035275f5533941ec6f2ba480ef4469dbd155e7c7604539a2a5f30660c3b75a66e4b8ba882520f255f67a2f9781c0a6621bedffed
- SSDEEP 196608:FJanaW40Y+X54dIrn7anaW40Y+X54dIrn4:WnabaX54dIrnmnabaX54dIrn4
- TLSH T11D863340CE00BEF4C45B2B746236DA67191BA59CA372EC660927777E71C143B6EA30F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/dreamspoofer/resources/udmapper.exe themida static1/unpack001/dreamspoofer/udmapper.exe themida - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/dreamspoofer/resources/dreamCleaner.exe unpack001/dreamspoofer/resources/udmapper.exe unpack001/dreamspoofer/udmapper.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/dreamspoofer/resources/tempv2.sys unpack001/dreamspoofer/tempv2.sys
File Explorer
-
dreamspoofer.zip.zip 7.9MB
-
dreamspoofer/cleaner stuff/FED9.bat.bat 104KB
-
dreamspoofer/fixed-decomp.py37KB
-
dreamspoofer/readme.txt449B
-
dreamspoofer/resources/cleaner stuff/FED9.bat.bat 104KB
-
dreamspoofer/resources/dreamCleaner.exe.exe 224KB
-
dreamspoofer/resources/tempv2.sys.sys 1.0MB
-
dreamspoofer/resources/udmapper.exe.exe 3.9MB
-
dreamspoofer/tempv2.sys.sys 1.0MB
-
dreamspoofer/udmapper.exe.exe 3.9MB
dreamspoofer/cleaner stuff/FED9.bat
- SHA256 bae4759483da860870bfcf32fbf9995bd92096f29c4f8507836a3038d8b2fd7f
- MD5 cbe07887333a77b4b80e15b4421ec6f1
- SHA1 3133524201bac56e92d276d5430aaa6ccaaab084
- SHA512 5c76ef45fbfa7e5af8a73e85b0f4541b43fa0d0c9b106581cccedca1dbdbc7a6e6234eaf4a4373c5fe70edb2948b0180347b78a623e8e1947c37e040fa6f8c5c
- SSDEEP 768:X/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJ6:vg8gU61nvplxL5LvLpLjLwY
- TLSH T126A3E392621895B2D96704CC83EF864D3C7CE0CA25F5376242F2BA4CD94A83C567ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
dreamspoofer/fixed-decomp.py
- SHA256 44c671dce0f559a2b9c79964f50927bafc857605d0ceb62c61ba52c10c5bc26d
- MD5 8ea4434aae6d379a2a5e1be42d69f045
- SHA1 9fee346b7b7589e6a2495d2738fabc41e77ba223
- SHA512 de3faf4fd9e8af364d892ea02b315834634082919e1e35d0b1ae22a818ee9edba1f10deb9e9e85ee5180d094c3c9d5cca173d6e689fc4441effa84e53a7f5fa5
- SSDEEP 768:4W/7U3LmIwB8dCTTi1+bjDEs7PaySD9u92x7SaqMIhhrnJ5a:4WYe2yMuBva
- TLSH T16303836AA5084012C393DDAE9857B8076F4F1EA7220D5634BDBCE1406FD523186F9FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
dreamspoofer/readme.txt
- SHA256 4e8a3f5e2cc44fc230cd3fbf616cca02d5aa1289a61ddea930a25a2c87e3562c
- MD5 02e8333875507bb872f0ae6476a7df69
- SHA1 32e94770900dd4a6d80381cb931523d16ce76b79
- SHA512 397a5f220042fbc955bc25e342ebba768fec6720878755056ffd1d5ddb5228ed1a367f84c60c038309ae7c57dc20bfff48fbb09e3c257a82e5ddac577e50654f
- TLSH T18FF05CB9578AE2714245D5687718BDC88F1204B8E30ED751DE650C4F629100C9312AE5
- MD5 SHA1 SHA512 TLSH
dreamspoofer/resources/cleaner stuff/FED9.bat
- SHA256 bae4759483da860870bfcf32fbf9995bd92096f29c4f8507836a3038d8b2fd7f
- MD5 cbe07887333a77b4b80e15b4421ec6f1
- SHA1 3133524201bac56e92d276d5430aaa6ccaaab084
- SHA512 5c76ef45fbfa7e5af8a73e85b0f4541b43fa0d0c9b106581cccedca1dbdbc7a6e6234eaf4a4373c5fe70edb2948b0180347b78a623e8e1947c37e040fa6f8c5c
- SSDEEP 768:X/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJ6:vg8gU61nvplxL5LvLpLjLwY
- TLSH T126A3E392621895B2D96704CC83EF864D3C7CE0CA25F5376242F2BA4CD94A83C567ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
dreamspoofer/resources/dreamCleaner.exe
- IMPHASH 7182b1ea6f92adbf459a2c65d8d4dd9e
- SHA256 172f6c873b246e71c6ecf1c0fffb57ca96bc93b7c55046433b4218f514eddf29
- MD5 1c55c014e426a853488ceb2b9e3e1e4c
- SHA1 e818495d167286154a36dab6e98c7c7a434bc6c1
- SHA512 b9534a16f231d94ccde98ee7515e1f647a1672fd17adee49c1dd79370c06ce7710edaa87262c06c409c8cad0c14e9cf54f7dddaf18ebbc860fbfdf2b38657ed3
- SSDEEP 6144:rt5hBPi0BW69hd1MMdxPe9N9uA069TB2ayKcDtbqGN8P1erIjECij:rtzww69TQayKcRbqs89eztj
- TLSH T18E249D57B2A01188EBF581F6D9920746E73074321725A3DB277852B71B2B8CA9F3D3E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
memcpy
tolower
wcscat
malloc
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
GetExitCodeProcess
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetShortPathNameW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
DestroyWindow
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
GetSystemMetrics
CreateWindowExW
SetWindowLongPtrW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
Name
.code
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
dreamspoofer/resources/tempv2.sys
- IMPHASH df552bc149e9cfef3db42fe67d0113d2
- SHA256 b395103a618ec58c406ebd3d02fab1ea312b60f6e6287f94ca8a6bd5bb429470
- MD5 1d4a330b99e381728a2f1aa6694bfc1a
- SHA1 47b08200382a58051d0442bc6a63832c129566da
- SHA512 f9d2a1d111d423d6270c435f3271d2d8fa7c9d9b1c1aacc1b5dc8dd2e01c2344476f40e05692433ef96c4058fd28a8b2b1a06d4a1b0faf4de4c2a2349196661e
- SSDEEP 384:jztVRdFf06hAAq5/7kFWwT2Wb/wfT3iEx7bLDUJrX:jzjRdtkwXi3iUbLDUpX
- TLSH T11A256CE67B203CD7EA6B4078E0D44127F571F1922B2105DF4BB1C16A8E577F22A3694E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9f:0e:6f:0d:f3:59:98:98:61:31:dd:83:59:f0:76:83:41:79:bc:32
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=zergravity
Chains
Sep 7, 2024
CN=zergravity
Subject
CN=DigiCert Inc.
Serial Number
4e:ce:7f:a7:a9:7b:d1:a1:4e:cf:4a:92:75:cf:91:f6
Issuer
CN=DigiCert Inc.
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 7, 2024 - Sep 7, 2054
Subject
CN=zergravity
Serial Number
1f:d5:96:11:6c:ce:fd:71:e0:fd:3c:1f:ed:4c:54:a9
Issuer
CN=DigiCert Inc.
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 7, 2024 - Sep 7, 2054
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
10
Entry point
5120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Matty\Desktop\KMDF Driver1\x64\Release\KMDFDriver1.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySystemInformation
RtlInitString
RtlInitUnicodeString
ExAllocatePool
IoGetDeviceObjectPointer
DbgPrintEx
RtlGetVersion
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeQueryUnbiasedInterruptTime
MmMapIoSpace
MmUnmapIoSpace
isupper
islower
isdigit
strstr
KeQueryTimeIncrement
RtlRandomEx
_vsnwprintf
hal
KeQueryPerformanceCounter
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=257, version=30795,
count=34, id=1, productName=Unmarked objects,
count=6, id=259, version=30795,
count=5, id=260, version=30795,
count=7, id=261, version=32537,
count=1, id=258, version=32537,
dreamspoofer/resources/udmapper.exe
- SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
- MD5 b7a6aae627a16e3e67825503c826933f
- SHA1 3b5385e392aec43b4507e145f50c895db31e9525
- SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
- SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
- TLSH T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6525016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
36KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
29KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=35, id=261, version=34321,
count=6, id=257, version=34321,
count=9, id=257, version=33138,
count=236, id=1, productName=Unmarked objects,
count=6, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
dreamspoofer/tempv2.sys
- IMPHASH df552bc149e9cfef3db42fe67d0113d2
- SHA256 b395103a618ec58c406ebd3d02fab1ea312b60f6e6287f94ca8a6bd5bb429470
- MD5 1d4a330b99e381728a2f1aa6694bfc1a
- SHA1 47b08200382a58051d0442bc6a63832c129566da
- SHA512 f9d2a1d111d423d6270c435f3271d2d8fa7c9d9b1c1aacc1b5dc8dd2e01c2344476f40e05692433ef96c4058fd28a8b2b1a06d4a1b0faf4de4c2a2349196661e
- SSDEEP 384:jztVRdFf06hAAq5/7kFWwT2Wb/wfT3iEx7bLDUJrX:jzjRdtkwXi3iUbLDUpX
- TLSH T11A256CE67B203CD7EA6B4078E0D44127F571F1922B2105DF4BB1C16A8E577F22A3694E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9f:0e:6f:0d:f3:59:98:98:61:31:dd:83:59:f0:76:83:41:79:bc:32
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=zergravity
Chains
Sep 7, 2024
CN=zergravity
Subject
CN=DigiCert Inc.
Serial Number
4e:ce:7f:a7:a9:7b:d1:a1:4e:cf:4a:92:75:cf:91:f6
Issuer
CN=DigiCert Inc.
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 7, 2024 - Sep 7, 2054
Subject
CN=zergravity
Serial Number
1f:d5:96:11:6c:ce:fd:71:e0:fd:3c:1f:ed:4c:54:a9
Issuer
CN=DigiCert Inc.
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 7, 2024 - Sep 7, 2054
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
10
Entry point
5120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Matty\Desktop\KMDF Driver1\x64\Release\KMDFDriver1.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySystemInformation
RtlInitString
RtlInitUnicodeString
ExAllocatePool
IoGetDeviceObjectPointer
DbgPrintEx
RtlGetVersion
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeQueryUnbiasedInterruptTime
MmMapIoSpace
MmUnmapIoSpace
isupper
islower
isdigit
strstr
KeQueryTimeIncrement
RtlRandomEx
_vsnwprintf
hal
KeQueryPerformanceCounter
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=257, version=30795,
count=34, id=1, productName=Unmarked objects,
count=6, id=259, version=30795,
count=5, id=260, version=30795,
count=7, id=261, version=32537,
count=1, id=258, version=32537,
dreamspoofer/udmapper.exe
- SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
- MD5 b7a6aae627a16e3e67825503c826933f
- SHA1 3b5385e392aec43b4507e145f50c895db31e9525
- SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
- SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
- TLSH T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6525016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
36KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
29KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=35, id=261, version=34321,
count=6, id=257, version=34321,
count=9, id=257, version=33138,
count=236, id=1, productName=Unmarked objects,
count=6, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,