703294a3703238664f834e6b6c5dd34fd4f84c15ea22d6923d3e3bb378afb086

Sharing

Copy URL Twitter E-mail

General

Target

703294a3703238664f834e6b6c5dd34fd4f84c15ea22d6923d3e3bb378afb086
Size

113KB
MD5

0c41a40eaec9e648cf5b18242f70a1d0
SHA1

a9e58181131a4318e7ae7ca93dadda1f73aa2004
SHA256

703294a3703238664f834e6b6c5dd34fd4f84c15ea22d6923d3e3bb378afb086
SHA512

90ae5866496f82eb7ff3fcaaa3a271d4f970dbd37c9ff361496b37ca6cbd174a64f3d90a327871baff2b266b64625628636ffdb9726521492690f767af996c8e
SSDEEP

1536:EbeddcV6dzdZXs1huFvYoE4Npb0uXiuCT5NlQP++LphggNepPW58WIw94W:Vts1huFW26uuqPTgcyy8WIO

Score

N/A

Malware Config

Signatures

Files

703294a3703238664f834e6b6c5dd34fd4f84c15ea22d6923d3e3bb378afb086
.exe windows x64

08e67e314e0d1176271cd7ee23d34053

Code Sign

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2012, 01:00

Not After

08/08/2027, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:62:b2:bf:70:fa:f0
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

22/11/2012, 17:21

Not After

25/11/2013, 02:32

Subject

CN=展扬信息技术有限公司,O=展扬信息技术有限公司,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c103931343633323430304071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:3e:54:e9:30:f1:a2:47:fc:29:be:37:78:ac:08:17:d9:23:30:a1
Signer

Actual PE Digest

69:3e:54:e9:30:f1:a2:47:fc:29:be:37:78:ac:08:17:d9:23:30:a1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=展扬信息技术有限公司,O=展扬信息技术有限公司,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c103931343633323430304071712e636f6d

04/11/2022, 15:41
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeEvent
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
IoCancelIrp
ZwCreateFile
IofCompleteRequest
ObReferenceObjectByHandle
IoFreeIrp
MmProbeAndLockPages
IoAllocateMdl
IofCallDriver
ZwCreateKey
IoDeleteSymbolicLink
ExReleaseFastMutex
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAcquireFastMutex
IoDeleteDevice
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
IoGetDeviceObjectPointer
ExSystemTimeToLocalTime
ZwQueryValueKey
rand
RtlRandomEx
KeQueryTimeIncrement
srand
RtlAppendUnicodeStringToString
ZwFlushKey
RtlFreeAnsiString
IoCreateSymbolicLink
IoCreateDevice
ZwDeleteKey
ZwOpenKey
ExFreePoolWithTag
KeReleaseSpinLock
ExAllocatePool
KeSetEvent
IoDetachDevice
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
_strnicmp
strstr
MmGetSystemRoutineAddress
_snprintf
strncpy
strrchr
PsGetCurrentThreadId
DbgPrint
ZwEnumerateKey
ExAllocatePoolWithTag
ZwFsControlFile
IoAttachDeviceToDeviceStackSafe
ZwQuerySymbolicLinkObject
ZwReadFile
swprintf
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwSetInformationFile
RtlFreeUnicodeString
ObQueryNameString
ZwWaitForSingleObject
PsCreateSystemThread
IoGetDeviceAttachmentBaseRef
IoCreateFileSpecifyDeviceObjectHint
ZwFlushBuffersFile
ZwDeleteFile
RtlCompareUnicodeString
ZwDeviceIoControlFile
RtlCopyUnicodeString
ZwQueryInformationFile
ZwWriteFile
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
KeInitializeTimerEx
KeCancelTimer
KeBugCheckEx
KeAcquireSpinLockRaiseToDpc
RtlInitUnicodeString
RtlAnsiCharToUnicodeChar
__C_specific_handler

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 378B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08e67e314e0d1176271cd7ee23d34053

Code Sign

19:6d:f8:a7Certificate

Key Usages

1c:62:b2:bf:70:fa:f0Certificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

3dCertificate

Key Usages

69:3e:54:e9:30:f1:a2:47:fc:29:be:37:78:ac:08:17:d9:23:30:a1Signer

Signature Validations

Verification

04/11/2022, 15:41 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 19KB

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 378B

19:6d:f8:a7
Certificate

1c:62:b2:bf:70:fa:f0
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

3d
Certificate

69:3e:54:e9:30:f1:a2:47:fc:29:be:37:78:ac:08:17:d9:23:30:a1
Signer

04/11/2022, 15:41
Valid: false

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 19KB

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 378B