9e4c856d59b3021fb7ce3cb2e0b1ed46e6b76841b201c08714ea64084a65bf05

Sharing

Copy URL

Twitter E-mail

General

Target

9e4c856d59b3021fb7ce3cb2e0b1ed46e6b76841b201c08714ea64084a65bf05
Size

140KB
MD5

650e6b0b6c582c7414f3b201c2b0c709
SHA1

73b509f1dbaba80645ca23b505fdb0e965c3d315
SHA256

9e4c856d59b3021fb7ce3cb2e0b1ed46e6b76841b201c08714ea64084a65bf05
SHA512

748da5460086170ba4b8fe07b1377cfe52a0dd95aac765acc69127d001eda3835c45cbf598ea4b36601dacab69a3d5ff2a71cb8cae655b4c1fcefb701bb26991
SSDEEP

3072:UAkFcHT0iCBCz5G07YPfWX+Gf3bcWRbrXAV5zny0uv9I2P:1QQbkCcB6rvBrwK0uHP

Score

N/A

Malware Config

Signatures

Files

9e4c856d59b3021fb7ce3cb2e0b1ed46e6b76841b201c08714ea64084a65bf05
.exe windows x86

8016af0946577978b850ddcb2536d17d

Code Sign

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-12-2009 21:57

Not After

07-03-2011 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-01-2010 21:12

Not After

04-01-2013 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15-09-2005 21:55

Not After

15-03-2016 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

a8:e7:f1:bf:c8:24:cb:77:ac:a7:7e:0c:bb:a0:0e:d9:2e:11:5d:e0
Signer

Actual PE Digest

a8:e7:f1:bf:c8:24:cb:77:ac:a7:7e:0c:bb:a0:0e:d9:2e:11:5d:e0

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12-05-2010 09:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_aullshr
_allmul
_aulldiv
RtlGetVersion
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
memset
KeQuerySystemTime
_aulldvrm
_allshl
KeTickCount
KeBugCheckEx

storport.sys

StorPortNotification
StorPortExtendedFunction
StorPortResume
StorPortGetLogicalUnit
StorPortPause
StorPortFreeRegistryBuffer
StorPortFreeDeviceBase
StorPortGetUncachedExtension
StorPortGetDeviceBase
StorPortRegistryRead
StorPortAllocateRegistryBuffer
StorPortSetDeviceQueueDepth
StorPortInitialize
StorPortReadPortUchar
StorPortReadPortUshort
StorPortReadPortUlong
StorPortReadPortBufferUchar
StorPortReadPortBufferUshort
StorPortReadPortBufferUlong
StorPortReadRegisterUchar
StorPortReadRegisterUshort
StorPortReadRegisterUlong
StorPortReadRegisterBufferUchar
StorPortReadRegisterBufferUshort
StorPortReadRegisterBufferUlong
StorPortWritePortUchar
StorPortWritePortUshort
StorPortWritePortUlong
StorPortWritePortBufferUchar
StorPortWritePortBufferUshort
StorPortWritePortBufferUlong
StorPortWriteRegisterUchar
StorPortWriteRegisterUshort
StorPortWriteRegisterUlong
StorPortWriteRegisterBufferUchar
StorPortWriteRegisterBufferUshort
StorPortWriteRegisterBufferUlong
StorPortGetBusData
StorPortSetBusDataByOffset
StorPortMoveMemory
StorPortGetScatterGatherList
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortResumeDevice
StorPortPauseDevice
StorPortSynchronizeAccess
StorPortDebugPrint
ScsiPortMoveMemory
ScsiPortNotification

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 433B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8016af0946577978b850ddcb2536d17d

Code Sign

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:b5:29:00:00:00:00:00:10Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

a8:e7:f1:bf:c8:24:cb:77:ac:a7:7e:0c:bb:a0:0e:d9:2e:11:5d:e0Signer

Signature Validations

Verification

12-05-2010 09:06 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

storport.sys

Sections

.text Size: 99KB - Virtual size: 98KB

.rdata Size: 512B - Virtual size: 433B

.data Size: 25KB - Virtual size: 25KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:b5:29:00:00:00:00:00:10
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

a8:e7:f1:bf:c8:24:cb:77:ac:a7:7e:0c:bb:a0:0e:d9:2e:11:5d:e0
Signer

12-05-2010 09:06
Valid: false

.text
Size: 99KB - Virtual size: 98KB

.rdata
Size: 512B - Virtual size: 433B

.data
Size: 25KB - Virtual size: 25KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB