875129c2e13b1a36ec5799965b440b50e438cefde4920101c61ebdaf9865500a

Sharing

Copy URL Twitter E-mail

General

Target

875129c2e13b1a36ec5799965b440b50e438cefde4920101c61ebdaf9865500a
Size

164KB
MD5

6c6460213cf740bf722089714db5b8f5
SHA1

ae5482cf3703d084ed215b1d33484bfda42391fe
SHA256

875129c2e13b1a36ec5799965b440b50e438cefde4920101c61ebdaf9865500a
SHA512

7311b1ae7ad2eaccb0d48e87c1048863ef491a9958ffe8e72275fb276640962e9fa9261c296f586b90fb4d18f758f7c22ad56d1b22307325a3099a8b7841dd60
SSDEEP

3072:PygUk+0E1Zo5wdxaytfZuevc0ynm3ibELcw6RKMvcPhdbq3r:ikUvdxZDu2mnfELcw6E

Score

N/A

Malware Config

Signatures

Files

875129c2e13b1a36ec5799965b440b50e438cefde4920101c61ebdaf9865500a
.exe windows x86

eac2953b8bca910a7ec1974ed2eadbcd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:68:0c:78:3b:72:8a:b2:a1:88:0d:f4:23:2d:ed:32
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/04/2006, 00:00

Not After

31/05/2009, 23:59

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

28:a7:45:30:ce:2e:e5:84:25:a3:4a:b9:5a:49:7c:fd:06:da:48:fc
Signer

Actual PE Digest

28:a7:45:30:ce:2e:e5:84:25:a3:4a:b9:5a:49:7c:fd:06:da:48:fc

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US

03/10/2022, 12:53
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
_purecall
IoFreeMdl
ZwOpenFile
KeBugCheckEx
MmLockPagableDataSection
MmUnlockPagableImageSection
KeQuerySystemTime
KeInitializeSpinLock
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
_allmul
_alldiv
KeTickCount
KeQueryTimeIncrement
RtlInitUnicodeString
ZwClose

hal

KfLowerIrql
KeGetCurrentIrql
KeStallExecutionProcessor
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql
KeRaiseIrqlToDpcLevel

ndis.sys

NdisAcquireReadWriteLock
NdisAllocateMemoryWithTag
NdisMDeregisterDevice
NdisInitializeReadWriteLock
NdisMRegisterDevice
NdisMFreeSharedMemory
NdisAllocateBuffer
NdisMAllocateSharedMemory
NdisAllocateBufferPool
NdisFreePacket
NdisFreePacketPool
NdisFreeBufferPool
NdisAllocatePacket
NdisAllocatePacketPool
NdisReleaseReadWriteLock
NdisSetTimer
NdisGetRoutineAddress
NdisMDeregisterInterrupt
NdisMSleep
NdisWaitEvent
NdisMCancelTimer
NdisMDeregisterAdapterShutdownHandler
NdisWriteErrorLogEntry
NdisSetEvent
NdisInitializeEvent
NdisMInitializeTimer
NdisMRegisterAdapterShutdownHandler
NdisMRegisterInterrupt
NdisReadNetworkAddress
NdisMInitializeScatterGatherDma
NdisMSetAttributesEx
NdisMSynchronizeWithInterrupt
NdisOpenConfiguration
NdisTerminateWrapper
NdisMRegisterMiniport
NdisGetVersion
NdisInitializeWrapper
NdisMRegisterIoPortRange
NdisMMapIoSpace
NdisFreeMemory
NdisMDeregisterIoPortRange
NdisMUnmapIoSpace
NdisWritePciSlotInformation
NdisReadPciSlotInformation
NdisSystemProcessorCount
NdisReadConfiguration
NdisMPciAssignResources
NdisMQueryAdapterResources
NdisResetEvent
NdisMSetPeriodicTimer
NdisCloseConfiguration

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eac2953b8bca910a7ec1974ed2eadbcd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

65:68:0c:78:3b:72:8a:b2:a1:88:0d:f4:23:2d:ed:32Certificate

Extended Key Usages

Key Usages

28:a7:45:30:ce:2e:e5:84:25:a3:4a:b9:5a:49:7c:fd:06:da:48:fcSigner

Signature Validations

Verification

03/10/2022, 12:53 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text Size: 118KB - Virtual size: 117KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 5KB - Virtual size: 7KB

PAGE Size: 4KB - Virtual size: 3KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 3KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

65:68:0c:78:3b:72:8a:b2:a1:88:0d:f4:23:2d:ed:32
Certificate

28:a7:45:30:ce:2e:e5:84:25:a3:4a:b9:5a:49:7c:fd:06:da:48:fc
Signer

03/10/2022, 12:53
Valid: false

.text
Size: 118KB - Virtual size: 117KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 5KB - Virtual size: 7KB

PAGE
Size: 4KB - Virtual size: 3KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 3KB - Virtual size: 3KB