Driver140.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2020-04-01 09:52 VT 46/73

Driver Name: Driver140.sys
MD5: 98e83bc4957947909ec7317643d74014
SHA1: b35ce9031d33dc304e9e7b71f9ec438d75d23743
SHA256: e2449ccc74e745c0339850064313bdd8dc0eff17b3a4e0882184c9576ac93a89
Imphash: 74cb5272939c3535feb98bcd96a408ed
Vhash: 016086651d15666657651iz62xz
Authentihash: d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3
Rich PE header hash: 84e6254ef34ee6a7ff6781f87f924adf
SSDEEP: 24576:2csvhpvJa+34cBX9/jtlyzlPZ9qIYeF5Sebl8Femak7ys28VmXiH8RQe7Gmz:jYzvQ+34mLyzxvYe7Gwmak7yMAzb7Gm
TLSH: T1A835AEAD64803389C41B84348423FD59B2F4561F57C8C6E7B1EB9EC06BAF966E506F0E
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2020-04-01 09:52
SpcSpOpusInfo: Globalsign 中国
VT detections: 46/73
Compilation time: 2020-03-25
PDB path: E:\Pubg\BlackBoneDrv\bin\x64\Win10Release\BlackBoneDrv10.pdb
Country submitter: United Kingdom, China
Flag: Malicious

Description

BlackBone is a Windows memory-hacking library with an optional kernel driver that provides stealthy DLL injection, manual PE/driver mapping, remote code execution and hooking, and kernel-level memory read/write, process-protection tampering, and memory hiding (https://github.com/darthton/blackbone)