3134ac55e846d50cd32ff981418c954f31b65565e7a386cd8d3dca4f604b2fdd

Sharing

Copy URL Twitter E-mail

General

Target

3134ac55e846d50cd32ff981418c954f31b65565e7a386cd8d3dca4f604b2fdd
Size

227KB
MD5

4369a01d6a29d865c81e0477b6ba102d
SHA1

1c8998f25e3a14c02e6735a222cbe9ef26a9a725
SHA256

3134ac55e846d50cd32ff981418c954f31b65565e7a386cd8d3dca4f604b2fdd
SHA512

6032c56e41964a267f1d48665d54ea32922c21070e3f82c2d1fdaa561b3ce01c07967fa7fa26ffbe16082784d1e11b29a26207518b853923692865b4a7847b55
SSDEEP

3072:qbmbn3dYWhbM+TuLddWJn4FgkWcF/l45HIQNG3n/CadPEL/GOCoq0GmfM2w99g25:I0dYWhbMkuLiJnOG5636ak0qeSDO

Score

N/A

Malware Config

Signatures

Files

3134ac55e846d50cd32ff981418c954f31b65565e7a386cd8d3dca4f604b2fdd
.exe windows x86

26a03d22f1e363f76d29c2117d77f3ff

Code Sign

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

05:95:c0:08:95:7b:11:fe:01:ea:c5:5b:8c:8c:13:6c:ac:cb:9a:c5
Signer

Actual PE Digest

05:95:c0:08:95:7b:11:fe:01:ea:c5:5b:8c:8c:13:6c:ac:cb:9a:c5

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2010, 12:30
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeTickCount
IoReleaseRemoveLockAndWaitEx
IoStopTimer
KeSetEvent
IoQueueWorkItem
IofCallDriver
MmLockPagableDataSection
IoStartTimer
PsGetCurrentProcess
IoInitializeTimer
IoRegisterBootDriverReinitialization
IoReportRootDevice
ExInitializeNPagedLookasideList
wcsncmp
IoCancelIrp
ZwClose
RtlQueryRegistryValues
ZwOpenKey
RtlWriteRegistryValue
ZwCreateKey
ExDeleteNPagedLookasideList
KeWaitForSingleObject
ObfDereferenceObject
rand
srand
KeQuerySystemTime
PsCreateSystemThread
IoReuseIrp
IoAllocateWorkItem
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateValueKey
KeDelayExecutionThread
wcschr
ZwEnumerateKey
PsTerminateSystemThread
KeSetBasePriorityThread
KeGetCurrentThread
KeInitializeEvent
IoFreeIrp
ExInterlockedPopEntrySList
IoAcquireRemoveLockEx
IoFreeWorkItem
IoOpenDeviceRegistryKey
memmove
ZwQueryValueKey
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
_wcsnicmp
_vsnwprintf
IoInitializeRemoveLockEx
ExInterlockedPushEntrySList
IoAllocateMdl
_alldiv
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
_itoa
_vsnprintf
KeQueryTimeIncrement
_allmul
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoBuildPartialMdl
MmUnmapLockedPages
IoBuildSynchronousFsdRequest
MmMapIoSpace
IoGetRelatedDeviceObject
ObfReferenceObject
IoGetDeviceProperty
IoGetDeviceInterfaces
ZwQuerySystemInformation
KeBugCheckEx
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memset
RtlUnwind
atoi
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
IoReleaseRemoveLockEx
IoFreeMdl
MmUnlockPagableImageSection
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
IoAllocateIrp
ExFreePoolWithTag

hal

KfAcquireSpinLock
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock

storport.sys

StorPortPauseDevice
StorPortResumeDevice
StorPortInitialize
StorPortExtendedFunction
StorPortNotification
ScsiPortMoveMemory

tdi.sys

TdiDeregisterPnPHandlers
TdiRegisterPnPHandlers

netio.sys

WskDeregister
WskReleaseProviderNPI
WskRegister
WskCaptureProviderNPI

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26a03d22f1e363f76d29c2117d77f3ff

Code Sign

61:04:b3:f5:00:00:00:00:00:0dCertificate

Extended Key Usages

Key Usages

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

05:95:c0:08:95:7b:11:fe:01:ea:c5:5b:8c:8c:13:6c:ac:cb:9a:c5Signer

Signature Validations

Verification

20/11/2010, 12:30 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

storport.sys

tdi.sys

netio.sys

Sections

.text Size: 151KB - Virtual size: 151KB

.rdata Size: 1024B - Virtual size: 792B

.data Size: 9KB - Virtual size: 9KB

PAGE Size: 1KB - Virtual size: 1KB

PAGELK Size: 41KB - Virtual size: 41KB

INIT Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

61:04:b3:f5:00:00:00:00:00:0d
Certificate

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

05:95:c0:08:95:7b:11:fe:01:ea:c5:5b:8c:8c:13:6c:ac:cb:9a:c5
Signer

20/11/2010, 12:30
Valid: false

.text
Size: 151KB - Virtual size: 151KB

.rdata
Size: 1024B - Virtual size: 792B

.data
Size: 9KB - Virtual size: 9KB

PAGE
Size: 1KB - Virtual size: 1KB

PAGELK
Size: 41KB - Virtual size: 41KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB