51bdbb2f4ae8b64772f9494f9ea5221d8bca8dda48bab934e2b96abf828f1a52

Sharing

Copy URL Twitter E-mail

General

Target

51bdbb2f4ae8b64772f9494f9ea5221d8bca8dda48bab934e2b96abf828f1a52
Size

102KB
MD5

8a75f2e8c31c4f8fe9a394ca15d454f4
SHA1

0270e8e049f3c08cb7b318cf12069a2b4cd2c60e
SHA256

51bdbb2f4ae8b64772f9494f9ea5221d8bca8dda48bab934e2b96abf828f1a52
SHA512

a67d44021a8d61d984f2dc603ce19aaffb94de6ca803f4570d25f9db6761e31c0286577647d2981676d2375037cc0e1c9fa45e9b5db4d4dd8d26bd65a80e9b37
SSDEEP

3072:aNu+eLE1yRyLU2zBluhmyGGhCc7Z8ZxthX0PZgLQLnLwQhf:ak+eLE19LU2zryGGhPOfthkBnL9hf

Score

N/A

Malware Config

Signatures

Files

51bdbb2f4ae8b64772f9494f9ea5221d8bca8dda48bab934e2b96abf828f1a52
.exe windows x86

3fa91e14a5030f676ec0761134b09262

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:f5:b9:78:8e:e6:d7:3b:69:8b:71:67:e0:8f:4c:3d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/07/2010, 00:00

Not After

25/07/2012, 23:59

Subject

CN=JMicron Technology Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JMicron Technology Corp.,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e9:c2:4e:31:f8:25:be:17:c3:0e:c1:94:88:b0:05:53:2f:dd:d1:b8
Signer

Actual PE Digest

e9:c2:4e:31:f8:25:be:17:c3:0e:c1:94:88:b0:05:53:2f:dd:d1:b8

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=JMicron Technology Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JMicron Technology Corp.,L=Hsinchu,ST=Taiwan,C=TW

29/10/2010, 10:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

scsiport.sys

ScsiPortWritePortUchar
ScsiPortGetBusData
ScsiPortLogError
ScsiPortInitialize
ScsiPortWritePortBufferUshort
ScsiPortCompleteRequest
ScsiPortGetDeviceBase
ScsiPortValidateRange
ScsiPortWritePortUlong
ScsiPortReadPortUlong
ScsiPortWritePortUshort
ScsiPortStallExecution
ScsiPortReadPortBufferUshort
ScsiPortSetBusDataByOffset
ScsiPortReadPortUchar
ScsiPortReadPortUshort
ScsiPortMoveMemory
ScsiPortNotification
ScsiPortGetUncachedExtension
ScsiPortGetPhysicalAddress

ntoskrnl.exe

KeTickCount
KeBugCheckEx
KeInitializeDpc
KeDelayExecutionThread
strncmp
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
IoGetDeviceProperty
ZwClose
PsCreateSystemThread
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoOpenDeviceRegistryKey
KeSetEvent
PoRequestPowerIrp
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
KeClearEvent
KeInsertQueueDpc
ExFreePoolWithTag
ObfDereferenceObject
KeInitializeSpinLock
ExAllocatePoolWithTag
PsTerminateSystemThread
ObReferenceObjectByHandle
RtlWriteRegistryValue
RtlQueryRegistryValues
KeInitializeEvent
PsGetVersion

hal

KfReleaseSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 363B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3fa91e14a5030f676ec0761134b09262

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

57:f5:b9:78:8e:e6:d7:3b:69:8b:71:67:e0:8f:4c:3dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

e9:c2:4e:31:f8:25:be:17:c3:0e:c1:94:88:b0:05:53:2f:dd:d1:b8Signer

Signature Validations

Verification

29/10/2010, 10:13 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

scsiport.sys

ntoskrnl.exe

hal

Sections

.text Size: 89KB - Virtual size: 88KB

.rdata Size: 512B - Virtual size: 363B

.data Size: 512B - Virtual size: 2KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 1KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

57:f5:b9:78:8e:e6:d7:3b:69:8b:71:67:e0:8f:4c:3d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

e9:c2:4e:31:f8:25:be:17:c3:0e:c1:94:88:b0:05:53:2f:dd:d1:b8
Signer

29/10/2010, 10:13
Valid: false

.text
Size: 89KB - Virtual size: 88KB

.rdata
Size: 512B - Virtual size: 363B

.data
Size: 512B - Virtual size: 2KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 1KB - Virtual size: 1KB