4512eb840ead6a4214fda01f96afab1626b1107837922a572d251308d9cdf4b6

Sharing

Copy URL Twitter E-mail

General

Target

4512eb840ead6a4214fda01f96afab1626b1107837922a572d251308d9cdf4b6
Size

783KB
MD5

003d5ddbecdd6256b0570e1a8574ad20
SHA1

4caac2f783b37f35a29d400560283f644e1c2fd5
SHA256

4512eb840ead6a4214fda01f96afab1626b1107837922a572d251308d9cdf4b6
SHA512

6c7d58d9ecdf1249904890b4db5a572216321c0c9234bcd6005c848fa1d0e2e13af6bebbb721cf5c4a48f2282d01e6d7720ab309d94ca960957319a99ce1a914
SSDEEP

12288:AoPMcy5hr4UCe8uLQrIYE8EdPz1n0/WGipK5d7AO7QlxxdmRyyp:AoPMcyd81FYPz8WGip0d7AhpdmRyyp

Score

N/A

Malware Config

Signatures

Files

4512eb840ead6a4214fda01f96afab1626b1107837922a572d251308d9cdf4b6
.exe windows x64

08e67e314e0d1176271cd7ee23d34053

Code Sign

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2012, 01:00

Not After

08/08/2027, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:62:b2:bf:70:fa:f0
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

22/11/2012, 17:21

Not After

25/11/2013, 02:32

Subject

CN=展扬信息技术有限公司,O=展扬信息技术有限公司,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c103931343633323430304071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b7:fe:1d:31:ce:4b:32:63:f6:ef:88:dc:59:c2:b8:6b:b1:f6:a9:d9
Signer

Actual PE Digest

b7:fe:1d:31:ce:4b:32:63:f6:ef:88:dc:59:c2:b8:6b:b1:f6:a9:d9

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=展扬信息技术有限公司,O=展扬信息技术有限公司,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c103931343633323430304071712e636f6d

04/11/2022, 15:42
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeEvent
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
IoCancelIrp
ZwCreateFile
IofCompleteRequest
ObReferenceObjectByHandle
IoFreeIrp
MmProbeAndLockPages
IoAllocateMdl
IofCallDriver
ZwCreateKey
IoDeleteSymbolicLink
ExReleaseFastMutex
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAcquireFastMutex
IoDeleteDevice
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
IoGetDeviceObjectPointer
ExSystemTimeToLocalTime
ZwQueryValueKey
rand
RtlRandomEx
KeQueryTimeIncrement
srand
RtlAppendUnicodeStringToString
ZwFlushKey
RtlFreeAnsiString
IoCreateSymbolicLink
IoCreateDevice
ZwDeleteKey
ZwOpenKey
ExFreePoolWithTag
KeReleaseSpinLock
ExAllocatePool
KeSetEvent
IoDetachDevice
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
_strnicmp
strstr
MmGetSystemRoutineAddress
_snprintf
strncpy
strrchr
PsGetCurrentThreadId
DbgPrint
ZwEnumerateKey
ExAllocatePoolWithTag
ZwFsControlFile
IoAttachDeviceToDeviceStackSafe
ZwQuerySymbolicLinkObject
ZwReadFile
swprintf
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwSetInformationFile
RtlFreeUnicodeString
ObQueryNameString
ZwWaitForSingleObject
PsCreateSystemThread
IoGetDeviceAttachmentBaseRef
IoCreateFileSpecifyDeviceObjectHint
ZwFlushBuffersFile
ZwDeleteFile
RtlCompareUnicodeString
ZwDeviceIoControlFile
RtlCopyUnicodeString
ZwQueryInformationFile
ZwWriteFile
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
KeInitializeTimerEx
KeCancelTimer
KeBugCheckEx
KeAcquireSpinLockRaiseToDpc
RtlInitUnicodeString
RtlAnsiCharToUnicodeChar
__C_specific_handler

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 378B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08e67e314e0d1176271cd7ee23d34053

Code Sign

19:6d:f8:a7Certificate

Key Usages

1c:62:b2:bf:70:fa:f0Certificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

3dCertificate

Key Usages

b7:fe:1d:31:ce:4b:32:63:f6:ef:88:dc:59:c2:b8:6b:b1:f6:a9:d9Signer

Signature Validations

Verification

04/11/2022, 15:42 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 19KB

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 378B

19:6d:f8:a7
Certificate

1c:62:b2:bf:70:fa:f0
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

3d
Certificate

b7:fe:1d:31:ce:4b:32:63:f6:ef:88:dc:59:c2:b8:6b:b1:f6:a9:d9
Signer

04/11/2022, 15:42
Valid: false

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 19KB

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 378B