aa055bc3c7eb7b318d58c4eae9f082a35eb7f1c940b91226d23783dd0432ff32

Sharing

Copy URL Twitter E-mail

General

Target

aa055bc3c7eb7b318d58c4eae9f082a35eb7f1c940b91226d23783dd0432ff32
Size

232KB
MD5

01e40cb95e26d62e8246daf0a2b8b290
SHA1

be244ff24dda595071e03af2188efd0dcae78511
SHA256

aa055bc3c7eb7b318d58c4eae9f082a35eb7f1c940b91226d23783dd0432ff32
SHA512

b6c3779752e4f9ff5f19f357489e656476d6bb887930cc02e898a63f4d3b4540717c7da293e945b45cf8f4547ca762dcc6de2a909e1dccc20cfc1af96431af59
SSDEEP

3072:R9dFhhktPDCUD123TgcD/uZq8qvZITDJY+hGMjWfvVS5rJn1171XlVe+w99AI7:JXetrH23McD/ulzfK+4MEUhVVLw9mI7

Score

N/A

Malware Config

Signatures

Files

aa055bc3c7eb7b318d58c4eae9f082a35eb7f1c940b91226d23783dd0432ff32
.exe windows x64

503465a1bd36634302aa5a2301ffb933

Code Sign

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2012, 01:00

Not After

08/08/2027, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:62:b2:bf:70:fa:f0
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

22/11/2012, 17:21

Not After

25/11/2013, 02:32

Subject

CN=展扬信息技术有限公司,O=展扬信息技术有限公司,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c103931343633323430304071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:d0:ab:2f:21:dc:0d:64:ff:88:d6:95:d3:59:03:0d:50:b4:73:eb
Signer

Actual PE Digest

78:d0:ab:2f:21:dc:0d:64:ff:88:d6:95:d3:59:03:0d:50:b4:73:eb

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=展扬信息技术有限公司,O=展扬信息技术有限公司,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c103931343633323430304071712e636f6d

04/11/2022, 15:41
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeEvent
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
IoCancelIrp
ZwCreateFile
IofCompleteRequest
ObReferenceObjectByHandle
IoFreeIrp
MmProbeAndLockPages
IoAllocateMdl
IofCallDriver
IoGetLowerDeviceObject
ZwCreateKey
IoDeleteSymbolicLink
ExReleaseFastMutex
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAcquireFastMutex
IoDeleteDevice
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwSetValueKey
ZwUnloadDriver
IoGetDeviceObjectPointer
ExSystemTimeToLocalTime
ZwQueryValueKey
rand
RtlRandomEx
KeQueryTimeIncrement
srand
RtlAppendUnicodeStringToString
ZwFlushKey
RtlFreeAnsiString
IoCreateSymbolicLink
IoCreateDevice
ZwDeleteKey
ZwOpenKey
ExFreePoolWithTag
KeReleaseSpinLock
KeSetEvent
KeAcquireSpinLockRaiseToDpc
IoDetachDevice
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
_strnicmp
strstr
MmGetSystemRoutineAddress
_snprintf
strncpy
strrchr
PsGetCurrentThreadId
DbgPrint
ZwEnumerateKey
ExAllocatePoolWithTag
ZwFsControlFile
IoAttachDeviceToDeviceStackSafe
ZwQuerySymbolicLinkObject
ZwReadFile
swprintf
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwSetInformationFile
RtlFreeUnicodeString
ObQueryNameString
ZwWaitForSingleObject
PsCreateSystemThread
IoGetDeviceAttachmentBaseRef
IoCreateFileSpecifyDeviceObjectHint
ZwFlushBuffersFile
RtlCompareUnicodeString
ZwDeviceIoControlFile
RtlCopyUnicodeString
ZwQueryInformationFile
ZwWriteFile
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
KeInitializeTimerEx
KeCancelTimer
KeBugCheckEx
ExAllocatePool
RtlInitUnicodeString
RtlAnsiCharToUnicodeChar
__C_specific_handler

hal

KeStallExecutionProcessor

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

503465a1bd36634302aa5a2301ffb933

Code Sign

19:6d:f8:a7Certificate

Key Usages

1c:62:b2:bf:70:fa:f0Certificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

3dCertificate

Key Usages

78:d0:ab:2f:21:dc:0d:64:ff:88:d6:95:d3:59:03:0d:50:b4:73:ebSigner

Signature Validations

Verification

04/11/2022, 15:41 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 7KB - Virtual size: 19KB

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 380B

19:6d:f8:a7
Certificate

1c:62:b2:bf:70:fa:f0
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

3d
Certificate

78:d0:ab:2f:21:dc:0d:64:ff:88:d6:95:d3:59:03:0d:50:b4:73:eb
Signer

04/11/2022, 15:41
Valid: false

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 7KB - Virtual size: 19KB

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 380B