Report - sk-data.special-k.info/redist/WinRing0

Report Overview

Visitedpublic

2025-05-12 20:29:24

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
sk-data.special-k.info	unknown	2020-07-28	2020-08-03	2025-05-09	512 B	34 kB	172.64.145.29

No alerts detected

No alerts detected

No alerts detected

No alerts detected

No alerts detected

URL

sk-data.special-k.info/redist/WinRing0_32.7z

IP / ASN

172.64.145.29

#13335 CLOUDFLARENET

File Overview

File Type7-zip archive data, version 0.4

Size33 kB (33430 bytes)

MD5f7d441d534b37441b08bdd1a6c4642b5

SHA194921471ec82ad1222a2524030b8f6c00b8844ee

SHA256d3d8fa22d876ebdf2996b581a7834c68c3d983516733333a225596aefab98af1

Archive (4)

Modified	Filename	Size	MD5	File type
2019-02-14 12:33	WinRing0.dll	20 kB	ee9de580406199f0f6789e90c68e2fc5	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections
2018-07-30 16:34	WinRing0.sys	14 kB	845af1ba23c8d5e64def61bcc441604c	PE32 executable (native) Intel 80386, for MS Windows, 6 sections
2019-02-14 12:45	WinRing0x64.dll	24 kB	168625537e17442935de4ab929f4e7e3	PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections
2018-07-30 16:33	WinRing0x64.sys	14 kB	0c0195c48b6b8582fa6f6373032118da	PE32+ executable (native) x86-64, for MS Windows, 6 sections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys
YARAhub by abuse.ch	malware	signed_sys_with_vulnerablity
Public Nextron YARA rules	malware	Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys
YARAhub by abuse.ch	malware	signed_sys_with_vulnerablity
VirusTotal	suspicious	VirusTotal - Scan result 1/60

	URL	IP	Response	Size