1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee

Sharing

Copy URL

Twitter E-mail

General

Target

1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee
Size

1.5MB
MD5

6132f1e4315b435ece3c79394123a155
SHA1

acdfb6ff29c249936c0c698221b4cfa046eee1f7
SHA256

1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee
SHA512

2cfadb1f08710a19087d4ef433c4754c0d9c25d94d62662b9fd4eaf2f672b76d285e52de7569aad9557e1e1a5018e4ec544437be6cf8bd787271c437b187dc7a
SSDEEP

24576:CUHw0+DSANpEIoIfJ/zwYuiYilpg7Au6tejBygfce7eaeb57DsK:z+GAzEX2sYuiYQTuQejBL3T457p

Score

N/A

Malware Config

Signatures

Files

1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee
.dll windows x64

998b3fde20393d5d9b52a90f8538b410

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:53

Not After

16-09-2011 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:55

Not After

16-09-2011 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:21:23:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-10-2007 22:09

Not After

18-12-2008 22:19

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

09-05-2001 23:19

Not After

09-05-2021 23:28

Subject

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15-09-2005 21:55

Not After

15-03-2016 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

7c:b3:19:c6:64:fa:05:38:61:8d:87:bb:1b:95:bd:f7:8f:d9:11:ed
Signer

Actual PE Digest

7c:b3:19:c6:64:fa:05:38:61:8d:87:bb:1b:95:bd:f7:8f:d9:11:ed

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27-03-2008 23:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetSystemWindowsDirectoryW
OutputDebugStringW
GetLastError
GetProcAddress
GetLocalTime
DecodePointer
GetEnvironmentVariableW
GetTempFileNameW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
WriteFile
LoadLibraryW
SizeofResource
GetExitCodeProcess
CreateFileW
LockResource
CloseHandle
GetWindowsDirectoryW
DeleteFileW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
FlsSetValue
GetCommandLineA
GetVersionExW
GetModuleHandleW
ExitProcess
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
FlushFileBuffers
SetStdHandle
WriteConsoleW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
FreeLibrary
HeapDestroy
EncodePointer
LocalFree
FormatMessageW

advapi32

OpenSCManagerW
OpenServiceW

setupapi

SetupCloseLog
SetupDiGetDeviceRegistryPropertyW
CM_Set_DevNode_Problem_Ex
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupDiSetDeviceInstallParamsW
SetupOpenLog

Exports

Exports

CoDeviceInstall
InstallStandaloneUmdfW
UpdateUmdf

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

998b3fde20393d5d9b52a90f8538b410

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:21:23:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65Certificate

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

7c:b3:19:c6:64:fa:05:38:61:8d:87:bb:1b:95:bd:f7:8f:d9:11:edSigner

Signature Validations

Verification

27-03-2008 23:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

setupapi

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 63KB

.data Size: 6KB - Virtual size: 14KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 1024B - Virtual size: 714B

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:21:23:00:00:00:00:00:06
Certificate

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

7c:b3:19:c6:64:fa:05:38:61:8d:87:bb:1b:95:bd:f7:8f:d9:11:ed
Signer

27-03-2008 23:36
Valid: false

.text
Size: 64KB - Virtual size: 63KB

.data
Size: 6KB - Virtual size: 14KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 1024B - Virtual size: 714B