3ae416677fd80c73b52e6434e8bd870bab82b0d8325895755d6a56ecbf0c7405

Sharing

Copy URL Twitter E-mail

General

Target

3ae416677fd80c73b52e6434e8bd870bab82b0d8325895755d6a56ecbf0c7405
Size

1.7MB
MD5

7d898d4ae0b134c221bc3c0d316d295a
SHA1

831c5ebe1f59dea917e07af2c4af7f95ce6e4b73
SHA256

3ae416677fd80c73b52e6434e8bd870bab82b0d8325895755d6a56ecbf0c7405
SHA512

d0704886092a91f04a469840422063143f2ff12c2ae19cd86b22a03f14517d52db04527a1d53854f3ef1b65c5d9883f22e750b6fe1b1bae34c7016b5963486d1
SSDEEP

24576:uZB9z57XhlycPvX8vI1Uu2WLKjMbpBm715vJNURTFtu8bmTuLSrAH9DFhwee0CHs:hc0UY2pBm715LUxEueAH+eCHLTU

Score

N/A

Malware Config

Signatures

Files

3ae416677fd80c73b52e6434e8bd870bab82b0d8325895755d6a56ecbf0c7405
.exe windows x86

b56635977b0269cf1489d4cb2cd3dbda

Code Sign

61:0b:bb:d8:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/04/2012, 20:55

Not After

09/07/2013, 20:55

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:d1:b8:6d:5d:6c:36:ca:fa:2b:a2:27:31:08:88:5d:f8:e4:69:2b:50:f1:db:c0:3c:3b:5b:77:09:7b:c9:bd
Signer

Actual PE Digest

05:d1:b8:6d:5d:6c:36:ca:fa:2b:a2:27:31:08:88:5d:f8:e4:69:2b:50:f1:db:c0:3c:3b:5b:77:09:7b:c9:bd

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/11/2022, 11:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlAnsiCharToUnicodeChar
MmProbeAndLockPages
ExAcquireRundownProtectionCacheAwareEx
ExReleaseRundownProtectionCacheAwareEx
RtlSetBits
RtlInitializeBitMap
RtlSetBit
RtlWriteRegistryValue
MmIsThisAnNtAsSystem
KeGetProcessorIndexFromNumber
KeQueryHighestNodeNumber
KeQueryNodeActiveAffinity
MmUnlockPagableImageSection
RtlSetGroupSecurityDescriptor
ExAcquireRundownProtection
ExReleaseRundownProtection
ExReInitializeRundownProtection
ExWaitForRundownProtectionRelease
ExInitializeRundownProtection
ExInitializeLookasideListEx
ExDeleteLookasideListEx
InterlockedExchange
SeQueryInformationToken
ObOpenObjectByPointer
ZwQueryInformationToken
SeTokenFromAccessInformation
SeAccessCheckFromState
ExAllocatePoolWithQuotaTag
ExUuidCreate
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
ExGetPreviousMode
KeDelayExecutionThread
ZwQueryLicenseValue
NtClose
NtQuerySecurityObject
MmIsVerifierEnabled
IoUninitializeWorkItem
IoInitializeWorkItem
IoSizeofWorkItem
SeReportSecurityEventWithSubCategory
SeSetAuditParameter
RtlEqualSid
KeQueryTimeIncrement
MmBadPointer
MmSizeOfMdl
MmUnmapLockedPages
KeExpandKernelStackAndCalloutEx
SeReleaseSubjectContext
SeUnlockSubjectContext
IoGetFileObjectGenericMapping
SeAccessCheck
SeLockSubjectContext
SeCaptureSubjectContextEx
ObLogSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
RtlLengthSid
SeExports
RtlCreateSecurityDescriptor
KeInsertQueueDpc
ExAllocatePoolWithTagPriority
RtlContractHashTable
RtlExpandHashTable
RtlCreateHashTable
KeInitializeSemaphore
RtlDeleteHashTable
KeFlushQueuedDpcs
ExGetCurrentProcessorCounts
KeCancelTimer
KeSetTimerEx
KeInitializeTimerEx
KeSetTargetProcessorDpcEx
KeGetProcessorNumberFromIndex
KeInitializeDpc
IoFreeWorkItem
IoQueueWorkItem
ExReleaseRundownProtectionCacheAware
ExAcquireRundownProtectionCacheAware
ExFreeCacheAwareRundownProtection
ExAllocateCacheAwareRundownProtection
ExWaitForRundownProtectionReleaseCacheAware
ExReInitializeRundownProtectionCacheAware
ZwQueryValueKey
ZwOpenKey
MmBuildMdlForNonPagedPool
RtlEndEnumerationHashTable
RtlEnumerateEntryHashTable
RtlInitEnumerationHashTable
RtlInitializeGenericTableAvl
RtlRemoveEntryHashTable
RtlInsertEntryHashTable
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
PsGetProcessSessionId
RtlLookupElementGenericTableFullAvl
KeIsExecutingDpc
ExNotifyCallback
KeQuerySystemTime
InterlockedPopEntrySList
RtlGetNextEntryHashTable
RtlLookupEntryHashTable
InterlockedPushEntrySList
ObDereferenceSecurityDescriptor
IoFreeMdl
IoBuildPartialMdl
IoAllocateMdl
MmMapLockedPagesSpecifyCache
KeBugCheckEx
ZwQuerySystemInformation
KeReleaseSemaphore
ObReferenceSecurityDescriptor
KeInitializeSpinLock
RtlGetVersion
KeTestSpinLock
KeReleaseInStackQueuedSpinLockFromDpcLevel
RtlEndWeakEnumerationHashTable
RtlWeaklyEnumerateEntryHashTable
RtlInitWeakEnumerationHashTable
KeAcquireInStackQueuedSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsGetProcessId
IofCallDriver
IoBuildDeviceIoControlRequest
ObfReferenceObject
IoGetDeviceObjectPointer
EtwWrite
KeGetCurrentProcessorNumberEx
KeQueryDpcWatchdogInformation
KeQueryInterruptTime
ExFreePoolWithTag
ExAllocatePoolWithTag
KeQueryMaximumProcessorCountEx
RtlVerifyVersionInfo
VerSetConditionMask
PsGetThreadProcess
PsIsSystemThread
KeGetCurrentThread
PsGetCurrentProcess
KeInitializeEvent
KeSetEvent
MmLockPagableDataSection
MmUnlockPages
MmUserProbeAddress
RtlIpv6StringToAddressA
KeQueryMaximumGroupCount
RtlTimeToTimeFields
KeGetRecommendedSharedDataAlignment
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlCreateHashTableEx
RtlEnumerateGenericTableLikeADirectory
KeSetCoalescableTimer
KeInitializeTimer
ZwEnumerateKey
RtlQueryRegistryValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlUnicodeStringToInteger
RtlCompareUnicodeString
RtlIntegerToUnicodeString
RtlCopySid
RtlSubAuthorityCountSid
ExfTryToWakePushLock
KeLeaveCriticalRegion
KeEnterCriticalRegion
ExfAcquirePushLockExclusive
PoUnregisterPowerSettingCallback
ExCreateCallback
ExRegisterCallback
PoRegisterPowerSettingCallback
ExUnregisterCallback
EtwWriteTransfer
EtwRegister
EtwUnregister
IoCreateDevice
ObfDereferenceObject
RtlCompareMemory
KeWaitForSingleObject
ObReferenceObjectByHandle
KeQueryActiveProcessorCountEx
ZwClose
IoGetCurrentProcess
KeReleaseMutex
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
KeInitializeMutex
KeReadStateEvent
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
PcwUnregister
PcwRegister
PcwAddInstance
IoQueueWorkItemEx
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
PsGetCurrentProcessId
RtlValidSid
RtlGetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlAddAccessAllowedAce
RtlMapGenericMask
RtlInitializeSid
RtlLengthRequiredSid
ObSetSecurityObjectByPointer
KeIsAttachedProcess
PsSetCreateProcessNotifyRoutineEx
ZwCreateFile
SeLocateProcessImageName
RtlSubAuthoritySid
KeUnstackDetachProcess
ZwDuplicateToken
KeStackAttachProcess
ZwOpenProcess
IofCompleteRequest
IoDeleteSymbolicLink
IoCreateSymbolicLink
KeTickCount
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
PsReferencePrimaryToken
PsReferenceImpersonationToken
ObCloseHandle
RtlQueryPackageIdentity
IoAllocateWorkItem
SeOpenObjectAuditAlarmForNonObObject
RtlFindClearBits
RtlAreBitsClear
RtlFindSetBits
RtlClearBits
ExInitializeResourceLite
ExDeleteResourceLite
RtlClearAllBits
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExAcquireResourceSharedLite
RtlTestBit
RtlClearBit
PsQueryProcessAttributesByToken
RtlPrefixUnicodeString
IoWMIRegistrationControl
RtlDowncaseUnicodeString
ZwOpenEvent
_alldiv
_allmul
_allshr
_aulldiv
_aullrem
memcmp
RtlUnwind

netio.sys

NetioNcmNotificationChannelContextRequest
NsiAllocateAndGetTable
NsiFreeTable
RtlInitializeToeplitzHash
RtlCleanupToeplitzHash
NetioAllocateNetBufferMdlAndDataPool
NetioAllocateNetBufferListNetBufferMdlAndDataPool
NetioFreeNetBufferMdlAndDataPool
NetioFreeNetBufferListNetBufferMdlAndDataPool
FsbFree
RtlIndicateTimerWheelEntryTimerStart
RtlResumeTimerWheel
RtlIsTimerWheelSuspended
FsbAllocateAtDpcLevel
NetioNcmFastCheckIsAoAcCapable
NetioNcmFastActiveReferenceRequest
NetioFreeMdl
NetioFreeNetBufferList
NetioExtendNetBuffer
NetioAllocateAndReferenceNetBufferListNetBufferMdlAndData
NetioAllocateNetBufferMdlAndData
NetioFreeNetBuffer
NetioDereferenceNetBufferListChain
NetioNcmTlObjectRequest
RtlComputeToeplitzHash
NetioNcmNotifyRedirectOnInterface
FsbAllocate
RtlInsertElementGenericTableBasicAvl
RtlDeleteElementGenericTableBasicAvl
RtlInitializeTimerWheelEntry
RtlSuspendTimerWheel
RtlGetNextExpirationTimerWheelTick
RtlCleanupTimerWheelEntry
RtlUpdateCurrentTimerWheelTick
RtlGetNextExpiredTimerWheelEntry
RtlReturnTimerWheelEntry
RtlCopyMdlToMdlIndirect
NetioAdvanceToLocationInNetBuffer
RtlCopyMdlToMdl
NmrClientAttachProvider
NmrRegisterClient
NmrDeregisterClient
NmrWaitForClientDeregisterComplete
NetioRegSyncDefaultChangeHandler
NetioRegSyncInterface
NetioNcmHandlePatternEviction
NetioSqmWriteEvent
NetioAllocateOpaquePerProcessorContext
NetioFreeOpaquePerProcessorContext
RtlCleanupTimerWheel
RtlInitializeTimerWheel
RtlInitializeTimerWheelEnumeration
RtlEnumerateNextTimerWheelEntry
RtlEndTimerWheelEnumeration
NsiSetAllParameters
NmrProviderDetachClientComplete
RtlCopyMdlToBuffer
NetioFreeNetBufferAndNetBufferList
RtlCopyBufferToMdl
NetioAllocateAndReferenceNetBufferAndNetBufferList
NetioCompleteCopyNetBufferListChain
NetioAllocateAndReferenceCopyNetBufferListEx
NetioCopyNetBufferListInformation
NetioInitializeNetBufferListContext
NetioFreeCopyNetBufferList
NetioRetreatNetBufferList
NmrRegisterProvider
NmrDeregisterProvider
NmrWaitForProviderDeregisterComplete
NmrClientDetachProviderComplete
TlDefaultRequestQueryDispatch
TlDefaultRequestMessage
TlDefaultRequestQueryDispatchEndpoint
NetioReferenceNetBufferList
TlDefaultRequestListen
TlDefaultRequestConnect
TlDefaultRequestCancel
TlDefaultRequestIoControl
NetioNcmGetAllNotificationChannelContextParameters
NetioShutdownWorkQueue
NetioNcmCleanupState
NetioNcmInitializeState
NetioNcmSignalNcContextWorkQueueRoutine
NetioInitializeWorkQueue
FsbDestroyPool
FsbCreatePool
KfdRegisterRscIncompatCalloutNotify
NetioInsertWorkQueue
WfpStreamInspectRemoteDisconnect
WfpStreamInspectReceive
NetioInitializeNetBufferListAndFirstNetBufferContext
NetioInitializeNetBufferListLibrary
NetioUnInitializeNetBufferListLibrary
NetioRegisterProcessorAddCallback
NetioUnRegisterProcessorAddCallback
NetioSqmTerminate
RtlInvokeStopRoutines
NetioSqmInitialize
NsiReferenceDefaultObjectSecurity
NsiRegisterChangeNotification
NsiDeregisterChangeNotification
NetioCompleteNetBufferListChain
NetioAllocateAndReferenceFragmentNetBufferList
IoctlKfdSetBfeEngineSd
IoctlKfdResetState
IoctlKfdQueryLayerStatistics
IoctlKfdAbortTransaction
IoctlKfdCommitTransaction
IoctlKfdDeleteCache
IoctlKfdAddCache
IoctlKfdBatchUpdate
IoctlKfdDeleteIndex
IoctlKfdAddIndex
SetWfpDeviceObject
NetioGetStatsForQoSFlow
NetioDeleteQoSFlow
NetioCreateQoSFlow
NetioAssociateQoSFlowWithNbl
KfdIsActiveCallout
FwpmEventProviderFireNetEvent0
FwpmEventProviderIsNetEventTypeEnabled0
FwpmEventProviderDestroy0
FwpmEventProviderCreate0
KfdAleUpdateEndpointContextStatus
WfpNblInfoAlloc
WfpPacketTagCountIncrement
WfpNblInfoDestroyIfUnused
NetioAllocateAndReferenceNetBufferList
NetioAllocateNetBuffer
HfDestroyFactory
HfCreateFactory
NetioNcmActiveReferenceRequest
PtGetNumNodes
PtCreateTable
PtDestroyTable
NetioCompleteNetBufferAndNetBufferListChain
NsiSetParameter
PtGetNextShorterMatch
PtGetLongestMatch
PtEnumOverTable
PtGetKey
PtDeleteEntry
PtInsertEntry
PtGetExactMatch
PtSetData
PtGetData
RtlCompute37Hash
NetioQueryNetBufferListTrafficClass
NetioExpandNetBuffer
NetioUpdateNetBufferListContext
NetioAllocateAndReferenceVacantNetBufferList
NetioAllocateAndReferenceCloneNetBufferList
NsiSetObjectSecurity
NsiResetPersistentSetting
NsiGetParameter
KfdIsDiagnoseEventEnabled
KfdCheckAndCacheAcceptBypass
KfdCheckAcceptBypass
KfdQueueLruCleanupWorkItem
KfdCheckAndCacheConnectBypass
KfdCheckConnectBypass
KfdGetLayerActionFromEnumTemplate
WfpExpireEntryLru
WfpSetBucketsToEmptyLru
KfdAleRemoveFlowContextTable
WfpScavangeLeastRecentlyUsedList
WfpLruProcessExpiredEndpoint
WfpInsertEntryLru
WfpDeleteEntryLru
WfpLruQueueLruCleanupWorkItemForContext
WfpUninitializeLeastRecentlyUsedList
WfpInitializeLeastRecentlyUsedList
KfdAleInitializeFlowTable
MatchCondition
KfdFreeEnumHandle
KfdDerefFilterContext
KfdGetNextFilter
KfdEnumLayer
KfdToggleFilterActivation
WfpStreamIsFilterPresent
NsiGetAllParameters
KfdAleAcquireEndpointContextFromFlow
KfdBfeEngineAccessCheck
FeReleaseCalloutContextList
FwppStreamDeleteDpcQueue
KfdAleNotifyFlowDeletion
KfdAleUninitializeFlowHandles
KfdAleInitializeFlowHandles
NetioUnInitializeFlowsManager
NetioInitializeFlowsManager
NetioFlowRemoveContext
NetioFlowRetrieveContext
NetioFlowAssociateContext
WfpNblInfoSetFlags
WfpNblInfoClearFlags
NetioReleaseFlow
NetioCreateForwardFlow
NetioRefreshFlow
NetioLookupForwardFlow
KfdAuditEvent
KfdDiagnoseEvent
KfdGetOffloadEpoch
KfdIsLsoOffloadPossibleV6
KfdIsLsoOffloadPossibleV4
KfdDirectClassify
KfdIsV6InTransportFastEmpty
KfdIsV4InTransportFastEmpty
KfdIsV6OutTransportFastEmpty
KfdIsV4OutTransportFastEmpty
WfpRefreshEntryLru
NetioAllocateAndReferenceCloneNetBufferListEx
NetioFreeCloneNetBufferList
KfdReleaseCachedFilters
NetioAdvanceNetBufferList
KfdCheckClassifyNeededAndUpdateEpoch
KfdAleReleaseFlowHandleForFlow
KfdClassify
KfdAleAcquireFlowHandleForFlow
KfdDeregisterLayerEventNotify
KfdSetWfpPerProcContextPtr
WfpNblInfoDispatchTableClear
KfdRegisterLayerEventNotify
WfpNblInfoDispatchTableSet
FwppTruncateStreamDataAfterOffset
FwppAdvanceStreamDataPastOffset
FwppCopyStreamDataToBuffer
FwppStreamContinue
FwppStreamInject
FeGetWfpGlobalPtr
KfdGetLayerCacheEpoch
RtlInvokeStartRoutines
NetioAllocateAndInitializeStackBlock
NetioFreeStackBlock
NetioStackBlockProcessorAddHandler
WfpNblInfoGet
WfpStartStreamShim
WfpStopStreamShim
NetioAllocateMdl
NetioDereferenceNetBufferList
KfdIsLayerEmpty
WfpStreamEndpointCleanupBegin
WfpStreamInspectSend
NsiGetParameterEx
WfpStreamInspectDisconnect

ndis.sys

NdisOffloadTcpDisconnect
NdisInvalidateOffload
NdisQueryOffloadState
NdisOffloadTcpForward
NdisTerminateOffload
NdisOffloadTcpReceiveReturn
NdisOffloadTcpReceive
NdisDeregisterProtocolDriver
NdisUpdateOffload
NdisFreeRWLock
NdisAllocateRWLock
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetSessionToCompartmentMappingEpochAndZero
NdisAcquireRWLockWrite
NdisReleaseRWLock
NdisAcquireRWLockRead
NdisInitiateOffload
NdisOffloadTcpSend
NdisIfQueryBindingIfIndex
NdisOpenAdapterEx
NdisCloseAdapterEx
NdisGetRssProcessorInformation
NdisCompleteNetPnPEvent
NdisDirectOidRequest
NdisCancelDirectOidRequest
NdisOidRequest
NdisCloseNDKAdapter
NdisOpenNDKAdapter
NdisCancelSendNetBufferLists
NdisReturnNetBufferLists
NdisRegisterProtocolDriver
NdisSendNetBufferLists
NdisGetDataBuffer
NdisSetOptionalHandlers
NdisFreeNetBufferList
NdisGetSessionCompartmentId
NdisAdjustNetBufferCurrentMdl
NdisGetThreadObjectCompartmentId
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart

fltmgr.sys

FltGetFileNameInformationUnsafe
FltReleaseFileNameInformation

fwpkclnt.sys

FwpsProxiedEndpointWasRedirectedToProxy
FwpmBfeStateUnsubscribeChanges0
FwpmBfeStateSubscribeChangesWithoutDevice0
FwpmEngineOpen0
FwpmEngineClose0
FwpsClassifyOptionSet0
FwpmSecureSocketDeleteByKeyAsync0
FwpmSecureSocketAddAsync0
FwpsInjectNetworkReceiveAsync0
FwpsForceReclassifyLayer0
FwpsCancelEndpointDeleteNotification0
FwpsRequestEndpointDeleteNotification0
FwppDispatchDevCtl0
IPsecDriverProcessClearTextResponse
IPsecDriverExpire
IPsecDriverInitiateAcquire
FwpsFreeNetBufferList0
FwpsReassembleForwardFragmentGroup0
FwppAllocateNetioCloneNetBufferList
FwpsNetBufferListRetrieveContext0
FwppProcessorAddHandler
FwpsIPSecGetPacketListSecurityInformation
FwppNetBufferListAssociateContext
FwpsQueryPacketInjectionState0
FwpsInjectionHandleDestroy0
FwpsInjectionHandleCreate0
FwpsInjectTransportSendAsync1
FwpsConstructIpHeaderForTransportPacket0
FwpsAllocateCloneNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsTcpIpDispatchTableAndGlobalsSet0
FwpsTcpIpDispatchTableClear0
FwppNetBufferListEventNotify
FwpsCalloutUnregisterByKey0
FwpsCalloutRegisterWithoutDevice0
FwpsProxiedEndpointUnRegisterForExitingEndpoint
FwpsProxiedEndpointClassifiableFieldGet
FwpsProxiedEndpointMetadataValueGet
FwpsProxiedEndpointRegisterForExitingEndpoint

hal

KeGetCurrentIrql
KfLowerIrql
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeQueryPerformanceCounter
KeRaiseIrqlToDpcLevel

ksecdd.sys

AcquireCredentialsHandleW
FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
DeleteSecurityContext
FreeCredentialsHandle
BCryptGenRandom
BCryptCreateHash
BCryptSetProperty
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptEncrypt
BCryptDecrypt
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
QuerySecurityContextToken

msrpc.sys

NdrMesTypeDecode2
MesHandleFree
I_RpcExceptionFilter
MesDecodeBufferHandleCreate

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEIPSE
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEIDP
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGERSS
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGECONS
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b56635977b0269cf1489d4cb2cd3dbda

Code Sign

61:0b:bb:d8:00:00:00:00:00:05Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

05:d1:b8:6d:5d:6c:36:ca:fa:2b:a2:27:31:08:88:5d:f8:e4:69:2b:50:f1:db:c0:3c:3b:5b:77:09:7b:c9:bdSigner

Signature Validations

Verification

28/11/2022, 11:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

netio.sys

ndis.sys

fltmgr.sys

fwpkclnt.sys

hal

ksecdd.sys

msrpc.sys

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 37KB - Virtual size: 92KB

PAGE Size: 38KB - Virtual size: 37KB

PAGEIPSE Size: 90KB - Virtual size: 90KB

PAGEIDP Size: 11KB - Virtual size: 10KB

PAGERSS Size: 10KB - Virtual size: 10KB

PAGECONS Size: 512B - Virtual size: 132B

PAGEDATA Size: - Virtual size: 4B

INIT Size: 25KB - Virtual size: 25KB

.rsrc Size: 222KB - Virtual size: 222KB

.reloc Size: 58KB - Virtual size: 57KB

61:0b:bb:d8:00:00:00:00:00:05
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

05:d1:b8:6d:5d:6c:36:ca:fa:2b:a2:27:31:08:88:5d:f8:e4:69:2b:50:f1:db:c0:3c:3b:5b:77:09:7b:c9:bd
Signer

28/11/2022, 11:52
Valid: false

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 37KB - Virtual size: 92KB

PAGE
Size: 38KB - Virtual size: 37KB

PAGEIPSE
Size: 90KB - Virtual size: 90KB

PAGEIDP
Size: 11KB - Virtual size: 10KB

PAGERSS
Size: 10KB - Virtual size: 10KB

PAGECONS
Size: 512B - Virtual size: 132B

PAGEDATA
Size: - Virtual size: 4B

INIT
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 222KB - Virtual size: 222KB

.reloc
Size: 58KB - Virtual size: 57KB