f946d1bc10162360a7513a8266512ab2027670cbd067925e81d03f179bad3e2b

Sharing

Copy URL Twitter E-mail

General

Target

f946d1bc10162360a7513a8266512ab2027670cbd067925e81d03f179bad3e2b
Size

136KB
MD5

903e0b5d168932bf8ca1f85f4f67454e
SHA1

50fea8adc1349fa193228c480da19158c188f761
SHA256

f946d1bc10162360a7513a8266512ab2027670cbd067925e81d03f179bad3e2b
SHA512

30f862f170d4c052615507d9bc79e88a823fbb4e59d6829139c837d2020cec6f4ac9a5a28ebb209900081b4eac5e927dd7afd3d79e4b17273847d1e8bad9c60b
SSDEEP

3072:ojhOdFxOuqXQdR1tlXC1NKYtKQun61+gzw2cd0Ls8LqT6cYP:IhOdHLqGbXLYtE6wgzwGs6TP

Score

N/A

Malware Config

Signatures

Files

f946d1bc10162360a7513a8266512ab2027670cbd067925e81d03f179bad3e2b
.exe windows x86

7cc1473f769d93b36b44d9828b647c4d

Code Sign

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5d:95:11:45:a8:d3:9a:31:c8:1c:cf:b6:f8:ad:d7:69:16:ee:5e:bc
Signer

Actual PE Digest

5d:95:11:45:a8:d3:9a:31:c8:1c:cf:b6:f8:ad:d7:69:16:ee:5e:bc

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2010, 12:30
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_vsnwprintf
IoFreeMdl
MmBuildMdlForNonPagedPool
KeInitializeEvent
MmUnlockPagableImageSection
MmLockPagableDataSection
IoInvalidateDeviceRelations
ExQueueWorkItem
KeQuerySystemTime
IoFreeIrp
KeLeaveCriticalRegion
KeEnterCriticalRegion
memcpy
RtlEqualString
RtlCopyString
RtlInitAnsiString
KeInitializeDeviceQueue
InterlockedPushEntrySList
IoCreateDevice
RtlInitUnicodeString
IoGetDriverObjectExtension
ZwClose
ZwOpenKey
IoOpenDeviceRegistryKey
KeGetCurrentThread
IoWMIWriteEvent
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlCompareMemory
KeInitializeDpc
IoWMIRegistrationControl
IofCompleteRequest
KeBugCheckEx
MmUnmapIoSpace
MmMapIoSpace
IoGetConfigurationInformation
RtlUnicodeStringToAnsiString
_wcsnicmp
ZwEnumerateValueKey
ZwQueryValueKey
ObReferenceObjectByHandle
ZwCreateDirectoryObject
IoAttachDeviceToDeviceStack
IoReportDetectedDevice
IoAllocateMdl
MmAllocateMappingAddress
ExInitializeNPagedLookasideList
_vsnprintf
MmGetPhysicalAddress
MmAllocateContiguousMemorySpecifyCache
_strnicmp
KeInitializeMutex
IoGetDmaAdapter
IoConnectInterrupt
KeSynchronizeExecution
KeInitializeTimer
IoInitializeTimer
IoQueryDeviceDescription
IoDeleteDevice
IoInvalidateDeviceState
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoAssignResources
RtlFreeUnicodeString
RtlStringFromGUID
ZwSetValueKey
KeClearEvent
RtlUnicodeStringToInteger
DbgPrint
IoAllocateDriverObjectExtension
IoFreeWorkItem
KeInsertByKeyDeviceQueue
MmMapLockedPagesWithReservedMapping
MmMapLockedPagesSpecifyCache
IoStartPacket
KeRemoveByKeyDeviceQueueIfBusy
ObfDereferenceObject
ObfReferenceObject
IoQueueWorkItem
IoAllocateWorkItem
IoStartNextPacket
MmUnmapLockedPages
IoBuildSynchronousFsdRequest
IoBuildAsynchronousFsdRequest
MmUnmapReservedMapping
KeSetTimer
_allmul
ZwCreateKey
ZwDeleteKey
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
RtlAnsiStringToUnicodeString
RtlQueryRegistryValues
PoRegisterDeviceForIdleDetection
KeInsertDeviceQueue
KeRemoveDeviceQueue
MmUnlockPages
MmProtectMdlSystemAddress
IoFreeErrorLogEntry
KeResetEvent
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
IoCreateSymbolicLink
IoStartTimer
IoDetachDevice
KeTickCount
memmove
PoRequestPowerIrp
PoCallDriver
PoStartNextPowerIrp
PoSetPowerState
MmFreeMappingAddress
ExDeleteNPagedLookasideList
MmFreeContiguousMemorySpecifyCache
IoDisconnectInterrupt
IoStopTimer
IoDeleteSymbolicLink
InterlockedPopEntrySList
IoGetDeviceProperty
DbgPrintEx
Mm64BitPhysicalAddress
IoAllocateIrp
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlGUIDFromString
KeQueryTimeIncrement
MmAddVerifierThunks
MmIsVerifierEnabled
MmProbeAndLockPages
MmLockPagableSectionByHandle
vDbgPrintExWithPrefix
RtlUnwind
KeSetEvent
KeWaitForSingleObject
KeReleaseMutex
ObReferenceObjectByPointer
memset
IoInitializeIrp
IofCallDriver
KeCancelTimer
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
ExFreePoolWithTag
KeInsertQueueDpc
RtlAreBitsSet
RtlInitializeBitMap
RtlClearAllBits
RtlCopyUnicodeString
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
IoCancelIrp
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
WmiTraceMessageVa
WmiQueryTraceInformation
RtlSetBits

hal

KeGetCurrentIrql
KeRaiseIrqlToDpcLevel
KeStallExecutionProcessor
HalGetInterruptVector
HalAssignSlotResources
HalGetBusData
HalSetBusDataByOffset
HalTranslateBusAddress
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql
KfLowerIrql

wmilib.sys

WmiFireEvent

Exports

Exports

DllInitialize
ScsiDebugPrint
ScsiPortCompleteRequest
ScsiPortConvertPhysicalAddressToUlong
ScsiPortConvertUlongToPhysicalAddress
ScsiPortFlushDma
ScsiPortFreeDeviceBase
ScsiPortGetBusData
ScsiPortGetDeviceBase
ScsiPortGetLogicalUnit
ScsiPortGetPhysicalAddress
ScsiPortGetSrb
ScsiPortGetUncachedExtension
ScsiPortGetVirtualAddress
ScsiPortInitialize
ScsiPortIoMapTransfer
ScsiPortLogError
ScsiPortMoveMemory
ScsiPortNotification
ScsiPortQuerySystemTime
ScsiPortReadPortBufferUchar
ScsiPortReadPortBufferUlong
ScsiPortReadPortBufferUshort
ScsiPortReadPortUchar
ScsiPortReadPortUlong
ScsiPortReadPortUshort
ScsiPortReadRegisterBufferUchar
ScsiPortReadRegisterBufferUlong
ScsiPortReadRegisterBufferUshort
ScsiPortReadRegisterUchar
ScsiPortReadRegisterUlong
ScsiPortReadRegisterUshort
ScsiPortSetBusDataByOffset
ScsiPortStallExecution
ScsiPortValidateRange
ScsiPortWritePortBufferUchar
ScsiPortWritePortBufferUlong
ScsiPortWritePortBufferUshort
ScsiPortWritePortUchar
ScsiPortWritePortUlong
ScsiPortWritePortUshort
ScsiPortWriteRegisterBufferUchar
ScsiPortWriteRegisterBufferUlong
ScsiPortWriteRegisterBufferUshort
ScsiPortWriteRegisterUchar
ScsiPortWriteRegisterUlong
ScsiPortWriteRegisterUshort

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELOCK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFY
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFY
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cc1473f769d93b36b44d9828b647c4d

Code Sign

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

5d:95:11:45:a8:d3:9a:31:c8:1c:cf:b6:f8:ad:d7:69:16:ee:5e:bcSigner

Signature Validations

Verification

20/11/2010, 12:30 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

wmilib.sys

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 752B

PAGE Size: 56KB - Virtual size: 55KB

PAGELOCK Size: 3KB - Virtual size: 3KB

PAGEVRFY Size: 1KB - Virtual size: 1KB

PAGEVRFY Size: 3KB - Virtual size: 3KB

.edata Size: 2KB - Virtual size: 2KB

INIT Size: 5KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

5d:95:11:45:a8:d3:9a:31:c8:1c:cf:b6:f8:ad:d7:69:16:ee:5e:bc
Signer

20/11/2010, 12:30
Valid: false

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 752B

PAGE
Size: 56KB - Virtual size: 55KB

PAGELOCK
Size: 3KB - Virtual size: 3KB

PAGEVRFY
Size: 1KB - Virtual size: 1KB

PAGEVRFY
Size: 3KB - Virtual size: 3KB

.edata
Size: 2KB - Virtual size: 2KB

INIT
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB