CLEAN — WinDivert64.sys

CLEAN — WinDivert64.sys is a pe sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (21/100). 2 of 55 detection engines flagged it.

Identification

• SHA-256: 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
• SHA-1: 4c9b9c74529399abacc2284de1dead5f2332ee9b
• MD5: 89ed5be7ea83c01d0de33d3519944aa5
• imphash: 5bfe3723089cbcfcc271ba6d7ab617aa
• ssdeep: 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
• TLSH: T1DE3A5CAC47EE8610E0B2DCA4E4105ACE5832B05866F2DA8E5607D1F740E6937DDF61E3
• Submitted as: WinDivert64.sys
• File type: pe · Size: 94144 bytes
• Verdict: clean (21/100)

Detections (2 of 55 engines)

• Microsoft Defender: flagged
• Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Multi.WinDivert.gen

Why this verdict

The clean score of 21/100 is the fusion of 1 weighted signal:

• Embedded network infrastructure: https://reqrypt.org/windivert.html - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
• http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
• https://sectigo.com/CPS0
• http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• https://www.microsoft.com/en-us/windows
• https://reqrypt.org/windivert.html

Embedded domains

• crl.comodoca.com
• crl.comodo.net
• crl.sectigo.com
• crt.sectigo.com
• crl.usertrust.com
• crt.usertrust.com
• sectigo.com
• www.microsoft.com
• crl.microsoft.com
• reqrypt.org

File paths

• C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report