El Análisis de Malware del Archivo ntoskrnl exe (NT Kernel & System) Microsoft Corporation

Tipo de Hash	Valor	Acción
MD5	69cd64e3fb9aa35a9a7525dcb9e37e51
SHA1	3c908405db496205d0ad7057dad7b7ad85dae8a9
SHA256	00bddcb825d2bbc566c6ffd80b5d41db1c49dba3f6dae68b3dc66676040a5bd3
SHA512	a6b712a82f2e2d2f65a6ec3c2ff31488a17c4f6cb8056b66052c3befa45bd6d998829ae8b6c7445a4ea914859f474ad12d3326ce507badb3c05e88fee6255d0e
ImpHash	e0e869bbd92f59b58e146ba81eee3f6d

Análisis PE

Información Básica

▼

Base de Imagen	`0x140000000`
Punto de Entrada	`0x140993010`
Tiempo de Compilación	2023-09-26 06:53:33
Suma de Verificación	0x00a6c1a4 (Real: 0x00a6c1a4)
Versión del SO	10.0
Firmas PEiD	`PE32+ executable (native) x86-64, for MS Windows`
Ruta PDB	`ntkrnlmp.pdb`
Firma Digital	OK
Importaciones	17 bibliotecas
Exportaciones	3093 funciones
Recursos	10 Recursos
Secciones	33 Secciones

Información de Versión

▼

CompanyName	Microsoft Corporation
FileDescription	NT Kernel & System
FileVersion	10.0.19041.5486 (WinBuild.160101.0800)
InternalName	ntkrnlmp.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	ntkrnlmp.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.19041.5486
Translation	0x0409 0x04b0

Secciones PE

▼

Nombre	Dirección Virtual	Tamaño Virtual	Tamaño Bruto	Entropía	Características	MD5
`.rdata`	`0x00001000`	819,872 bytes	820,224 bytes	5.88 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ`	`2D53922B7D20EE461FF1F3560A13A917`
`.pdata`	`0x000ca000`	424,416 bytes	424,448 bytes	6.54 (Comprimido)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ`	`DD830BDC22FBC741FA8A4C1298A3B0B4`
`.idata`	`0x00132000`	8,386 bytes	8,704 bytes	4.76 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ`	`4F14B29BEB7F0E2E44288AE25925C434`
`.edata`	`0x00135000`	101,758 bytes	101,888 bytes	6.03 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CFBD95741A52C890F04B5C4D71A38C93`
`PROTDATA`	`0x0014e000`	1 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ`	`BF619EAC0CDF3F68D496EA9344137E8B`
`GFIDS`	`0x0014f000`	35,912 bytes	36,352 bytes	5.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`4CF1A4C679D771E4AAC9784B1ACFE5B4`
`Pad1`	`0x00158000`	688,128 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.text`	`0x00200000`	3,985,769 bytes	3,985,920 bytes	6.54 (Comprimido)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`033B8D3DA648D0C2FB00308927E7F1C5`
`PAGE`	`0x005ce000`	3,951,350 bytes	3,951,616 bytes	6.50 (Comprimido)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`FD5D9618C60137458BDF8086BE83A4B8`
`PAGELK`	`0x00993000`	151,300 bytes	151,552 bytes	6.54 (Comprimido)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`BD28331E179C6E1DBDB23A568C5406E3`
`POOLCODE`	`0x009b8000`	1,163 bytes	1,536 bytes	5.14 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`74B3E29376397AE907C3BDF6F820162B`
`PAGEKD`	`0x009b9000`	23,442 bytes	23,552 bytes	6.49 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0443949D764DBF79F3074A1A80FD64F3`
`PAGEVRFY`	`0x009bf000`	205,068 bytes	205,312 bytes	6.41 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2F30ACABC0780D7F62E41C1840856537`
`PAGEHDLS`	`0x009f2000`	9,686 bytes	9,728 bytes	6.28 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`EDC12BB904154D84D41258C01A636F5C`
`PAGEBGFX`	`0x009f5000`	27,098 bytes	27,136 bytes	6.55 (Comprimido)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2112A49F6A6B9573A7244A28155200BF`
`INITKDBG`	`0x009fc000`	103,866 bytes	103,936 bytes	6.29 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`132BD1321C2B98EBE6700F947897A7A6`
`TRACESUP`	`0x00a16000`	5,979 bytes	6,144 bytes	6.21 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`002161DB8C7DC616649D23962904457A`
`KVASCODE`	`0x00a18000`	9,259 bytes	9,728 bytes	5.40 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`DA23309E877325ECCD06C9125449A019`
`RETPOL`	`0x00a1b000`	1,824 bytes	2,048 bytes	4.64 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`7476413DAD08097E4708671966C48AAB`
`MINIEX`	`0x00a1c000`	9,646 bytes	9,728 bytes	5.93 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`43C06F6F07DD23927B5695F4BEA561D9`
`INIT`	`0x00a1f000`	567,080 bytes	567,296 bytes	6.40 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`085E8C34299565E7FCFF52307725C0C4`
`Pad2`	`0x00aaa000`	1,400,832 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x00c00000`	1,025,424 bytes	77,824 bytes	1.29 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`25E228245701E54552550DE892A9B867`
`ALMOSTRO`	`0x00cfb000`	160,480 bytes	5,120 bytes	2.83 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`56E686C96781267783E1DDA6D4A48D5E`
`CACHEALI`	`0x00d23000`	37,568 bytes	512 bytes	0.16 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8F35CB33CC79A0D5EB136F8B15785BD3`
`PAGEDATA`	`0x00d2d000`	83,472 bytes	6,144 bytes	2.17 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D2BC23BD5C237CE20596DBC644750FA5`
`PAGEVRFD`	`0x00d42000`	89,344 bytes	32,768 bytes	2.89 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B4CA172CBF0A41540A3B5A9ECAFE6B87`
`INITDATA`	`0x00d58000`	113,732 bytes	2,048 bytes	2.38 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`25C7D86DC11AF4943C51BCD20760CFC3`
`Pad3`	`0x00d74000`	573,440 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`CFGRO`	`0x00e00000`	7,368 bytes	7,680 bytes	0.11 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E633F078657052BF3AFA259CD4304E52`
`Pad4`	`0x00e02000`	2,088,960 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x01000000`	241,720 bytes	242,176 bytes	2.19 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`16DC94E4858FAE510C8F251E45B9F1B4`
`.reloc`	`0x0103c000`	40,032 bytes	40,448 bytes	5.83 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`0296118517D50B84F5F1CCDA09899613`

Alerta de Análisis de Entropía

5 sección(es) con entropía elevada (≥6.5) - posible compresión

Análisis de Recursos

▼

Total de Recursos: 10 (241,076 bytes)

Tipo de Recurso	Cantidad	Tamaño Total	Porcentaje
RT_BITMAP	7	190,520 bytes	79%
RT_RCDATA	1	32,312 bytes	13.4%
RT_MESSAGETABLE	1	17,320 bytes	7.2%
RT_VERSION	1	924 bytes	0.4%

Análisis de la Cadena de Certificados

▼

Certificado Information

Producto	Microsoft® Windows® Operating System
Descripción	NT Kernel & System
Versión del Archivo	10.0.19041.5486 (WinBuild.160101.0800)
Nombre Original	ntkrnlmp.exe
Fecha de Firma	05:01 AM 01/23/2025 (234 días atrás)
Estado de Verificación	Signed
Firmantes	Microsoft Windows; Microsoft Windows Production PCA 2011; Microsoft Root Certificate Authority 2010
Contrafirmantes	Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010
Nombre Interno	ntkrnlmp.exe
Copyright	© Microsoft Corporation. All rights reserved.

Resumen de la Cadena de Certificados

Microsoft Windows #1 Principal

Período de Validez: 2024-09-12 20:04:06 → 2025-09-11 20:04:06

Algoritmo de Firma: sha256RSA

Número de Serie: 33 00 00 04 A7 04 3E E4 22 C8 34 FA FC 00 00 00 00 04 A7

Microsoft Windows Production PCA 2011 #2 Cadena

Período de Validez: 2011-10-19 18:41:42 → 2026-10-19 18:51:42

Algoritmo de Firma: sha256RSA

Número de Serie: 61 07 76 56 00 00 00 00 00 08

Microsoft Time-Stamp Service #3 Cadena

Período de Validez: 2024-07-25 18:31:09 → 2025-10-22 18:31:09

Algoritmo de Firma: sha256RSA

Número de Serie: 33 00 00 01 F9 1F 67 8D 75 AB A4 F1 B1 00 01 00 00 01 F9

Microsoft Time-Stamp PCA 2010 #4 Cadena

Período de Validez: 2021-09-30 18:22:25 → 2030-09-30 18:32:25

Algoritmo de Firma: sha256RSA

Número de Serie: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

✓ Este archivo ha sido firmado digitalmente y la cadena de certificados ha sido verificada.

La firma garantiza la integridad del archivo y la autenticidad del editor.
La marca de tiempo demuestra cuándo se aplicó la firma.

Nombre del Archivo	ntoskrnl.exe
Tipo de Archivo	PE32+ executable (native) x86-64, for MS Windows
Versión del Escáner	1.0.210.174
Versión de la Base de Datos	2025-03-13 00:00:48 UTC

El Análisis del Archivo ntoskrnl.exe (NT Kernel & System)

Análisis Técnico

Archivo Limpio

Escanear Otro Archivo

Identificación del Archivo

Análisis PE

Información Básica

Información de Versión

Secciones PE

Alerta de Análisis de Entropía

Análisis de Recursos

Análisis de la Cadena de Certificados

Certificado Information

Resumen de la Cadena de Certificados

Estado de Verificación del Certificado

Recuerde: Este es el Resultado del Escáner de Virus en Línea

Mantenga Su Sistema Protegido

Dejar un Comentario

Gridinsoft Anti-Malware