16efe2d1431304d9b79713ad4a080dd50c68babc5febc65568f0fb6392bc1fa3

Sharing

Copy URL Twitter E-mail

General

Target

16efe2d1431304d9b79713ad4a080dd50c68babc5febc65568f0fb6392bc1fa3
Size

1.2MB
MD5

47bb5fee16019dada7d1833e9f8d5db9
SHA1

46f037320e66c61fd7335711edd7818a1d9e2519
SHA256

16efe2d1431304d9b79713ad4a080dd50c68babc5febc65568f0fb6392bc1fa3
SHA512

64a2f7799451ff1ab842dd595d189a69f7f401d419b1c21bf98aa66e46ad1bf1cde934bef4f00ba02847bbb0e9edf86d887c1090cd60acf49c0b1951bdb46b61
SSDEEP

24576:6nvuur/YmFyHPX+gSmfwlYNFxE4LSG+M4XG8nKozV6shstBIQ:e/NFyHv+0oGN3XE3aBIQ

Score

N/A

Malware Config

Signatures

Files

16efe2d1431304d9b79713ad4a080dd50c68babc5febc65568f0fb6392bc1fa3
.exe windows x86

5b3d433b93a8e3b41e74295030727e94

Code Sign

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:03:05:56:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14/02/2011, 21:11

Not After

14/05/2012, 21:11

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

0c:03:e5:26:d5:b4:b3:78:72:5d:f5:fe:7b:94:91:af:b5:c9:d0:f1
Signer

Actual PE Digest

0c:03:e5:26:d5:b4:b3:78:72:5d:f5:fe:7b:94:91:af:b5:c9:d0:f1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/05/2011, 05:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmUserProbeAddress
MmLockPagableDataSection
RtlUnwind
RtlAnsiCharToUnicodeChar
PsGetCurrentProcessId
MmProbeAndLockPages
ExAcquireRundownProtectionCacheAwareEx
ExReleaseRundownProtectionCacheAwareEx
ExReInitializeRundownProtectionCacheAware
ExWaitForRundownProtectionReleaseCacheAware
RtlInitializeBitMap
RtlSetBits
ExFreeCacheAwareRundownProtection
ExAllocateCacheAwareRundownProtection
RtlSetBit
ExInitializeLookasideListEx
ExDeleteLookasideListEx
InterlockedExchange
SeReportSecurityEventWithSubCategory
ZwOpenKey
ZwQueryValueKey
MmSizeOfMdl
MmUnmapLockedPages
ObLogSecurityDescriptor
SeCaptureSubjectContextEx
SeLockSubjectContext
KeBugCheckEx
KeTickCount
EtwWriteTransfer
IoGetFileObjectGenericMapping
SeAccessCheck
SeUnlockSubjectContext
SeReleaseSubjectContext
RtlCreateSecurityDescriptor
SeExports
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAceEx
RtlSetDaclSecurityDescriptor
ExInterlockedFlushSList
KeInitializeSemaphore
ExAllocatePoolWithTagPriority
KeExpandKernelStackAndCalloutEx
VerSetConditionMask
RtlVerifyVersionInfo
KeInitializeTimerEx
ExGetCurrentProcessorCounts
KeSetTimerEx
KeQueryInterruptTime
KeCancelTimer
KeFlushQueuedDpcs
RtlExpandHashTable
RtlContractHashTable
RtlCreateHashTable
RtlDeleteHashTable
KeWaitForMultipleObjects
KeQueryGroupAffinity
KeInsertQueueDpc
KeGetProcessorNumberFromIndex
KeInitializeDpc
KeSetTargetProcessorDpcEx
KeSetImportanceDpc
MmUnlockPages
IoFreeWorkItem
IoQueueWorkItem
MmBuildMdlForNonPagedPool
RtlInitializeGenericTableAvl
KeQuerySystemTime
RtlEnumerateEntryHashTable
RtlInitEnumerationHashTable
RtlEndEnumerationHashTable
RtlLookupElementGenericTableFullAvl
ObDereferenceSecurityDescriptor
RtlRemoveEntryHashTable
RtlInsertEntryHashTable
RtlGetNextEntryHashTable
RtlLookupEntryHashTable
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
ExNotifyCallback
KeIsExecutingDpc
PsGetProcessSessionId
InterlockedPushEntrySList
InterlockedPopEntrySList
IoAllocateMdl
IoBuildPartialMdl
IoFreeMdl
MmMapLockedPagesSpecifyCache
ZwQuerySystemInformation
ObReferenceSecurityDescriptor
KeReleaseSemaphore
RtlInitWeakEnumerationHashTable
RtlWeaklyEnumerateEntryHashTable
RtlEndWeakEnumerationHashTable
KeQueryMaximumProcessorCountEx
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeGetCurrentProcessorNumberEx
RtlGetVersion
KeTestSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
PsGetProcessId
ExCreateCallback
EtwWrite
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfReferenceObject
PsGetCurrentProcess
PsIsSystemThread
PsGetThreadProcess
KeGetCurrentThread
KeInitializeEvent
KeSetEvent
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlTimeToTimeFields
RtlEnumerateGenericTableLikeADirectory
KeInitializeTimer
KeSetCoalescableTimer
KeLeaveCriticalRegion
KeEnterCriticalRegion
ExfTryToWakePushLock
ExfAcquirePushLockExclusive
RtlValidSid
ZwEnumerateKey
RtlQueryRegistryValues
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
SeSetAuditParameter
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
EtwUnregister
EtwRegister
IoGetCurrentProcess
KeInitializeMutex
IoCreateDevice
IoDeleteDevice
KeReadStateEvent
KeWaitForSingleObject
KeQueryActiveProcessorCountEx
KeReleaseMutex
ObfDereferenceObject
ZwOpenEvent
ObReferenceObjectByHandle
ZwClose
IofCallDriver
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memset
memcpy
ExAllocatePoolWithTag
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
RtlPrefixUnicodeString
RtlCopySid
RtlEqualUnicodeString
RtlUnicodeStringToInteger
RtlCompareUnicodeString
RtlLengthRequiredSid
RtlInitializeSid
RtlAddAccessAllowedAce
ObSetSecurityObjectByPointer
PsSetCreateProcessNotifyRoutineEx
SeLocateProcessImageName
ZwCreateFile
RtlDowncaseUnicodeString
ZwOpenProcess
KeStackAttachProcess
ZwDuplicateToken
KeUnstackDetachProcess
IoDeleteSymbolicLink
IoCreateSymbolicLink
KeQueryTimeIncrement
PsReferenceImpersonationToken
PsDereferencePrimaryToken
KeDelayExecutionThread
PsDereferenceImpersonationToken
ObCloseHandle
RtlSubAuthorityCountSid
RtlSubAuthoritySid
SeQueryInformationToken
ObOpenObjectByPointer
ZwQueryInformationToken
ExGetPreviousMode
ExUuidCreate
RtlEqualSid
ExAllocatePoolWithQuotaTag
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
IoAllocateWorkItem
RtlFindSetBits
RtlAreBitsClear
RtlFindClearBits
RtlClearBits
ExDeleteResourceLite
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
RtlClearBit
RtlClearAllBits
SeOpenObjectAuditAlarmForNonObObject
ExInitializeResourceLite
RtlTestBit
KeBugCheck
RtlIntegerToUnicodeString
IoWMIWriteEvent
PsReferencePrimaryToken
ExFreePoolWithTag

netio.sys

NetioFreeNetBufferListNetBufferMdlAndDataPool
NetioFreeMdl
RtlIndicateTimerWheelEntryTimerStart
RtlResumeTimerWheel
RtlIsTimerWheelSuspended
NetioAllocateNetBufferListNetBufferMdlAndDataPool
NetioAllocateNetBufferMdlAndDataPool
FsbFree
NetioFreeNetBufferList
NetioExtendNetBuffer
NetioFreeNetBuffer
NetioDereferenceNetBufferList
NetioAllocateAndReferenceNetBufferListNetBufferMdlAndData
NetioAllocateNetBufferMdlAndData
NetioDereferenceNetBufferListChain
FsbAllocateAtDpcLevel
NetioShutdownWorkQueue
RtlInitializeTimerWheelEntry
RtlComputeToeplitzHash
RtlSuspendTimerWheel
RtlGetNextExpirationTimerWheelTick
RtlCleanupTimerWheelEntry
RtlReturnTimerWheelEntry
RtlGetNextExpiredTimerWheelEntry
RtlUpdateCurrentTimerWheelTick
RtlDeleteElementGenericTableBasicAvl
NetioInitializeWorkQueue
RtlInsertElementGenericTableBasicAvl
FsbAllocate
NetioAdvanceToLocationInNetBuffer
RtlCopyMdlToMdlIndirect
NetioRegSyncDefaultChangeHandler
NetioRegSyncInterface
RtlCleanupTimerWheel
RtlInitializeTimerWheel
RtlEndTimerWheelEnumeration
RtlEnumerateNextTimerWheelEntry
RtlInitializeTimerWheelEnumeration
NetioFreeOpaquePerProcessorContext
NetioAllocateOpaquePerProcessorContext
NetioSqmWriteEvent
NsiSetAllParameters
TlDefaultRequestQueryDispatchEndpoint
TlDefaultRequestMessage
TlDefaultRequestQueryDispatch
RtlCopyMdlToBuffer
NetioFreeNetBufferAndNetBufferList
NetioAllocateAndReferenceNetBufferAndNetBufferList
RtlCopyBufferToMdl
NmrWaitForClientDeregisterComplete
NmrDeregisterClient
NmrClientDetachProviderComplete
NmrClientAttachProvider
NmrRegisterClient
NmrProviderDetachClientComplete
NmrWaitForProviderDeregisterComplete
NmrDeregisterProvider
NmrRegisterProvider
NetioRetreatNetBufferList
NetioAllocateAndReferenceCopyNetBufferListEx
NetioCompleteCopyNetBufferListChain
NetioFreeCopyNetBufferList
NetioInitializeNetBufferListContext
TlDefaultRequestCancel
TlDefaultRequestConnect
TlDefaultRequestListen
NetioReferenceNetBufferList
TlDefaultRequestIoControl
NetioFreeNetBufferMdlAndDataPool
RtlCleanupToeplitzHash
RtlInitializeToeplitzHash
NsiAllocateAndGetTable
NsiFreeTable
WfpStartStreamShim
WfpStartMacShim
NetioAllocateMdl
NetioInsertWorkQueue
WfpStreamInspectRemoteDisconnect
WfpStreamInspectReceive
WfpStreamInspectDisconnect
WfpStreamInspectSend
WfpStreamEndpointCleanupBegin
WfpStopStreamShim
FsbCreatePool
FsbDestroyPool
NetioStackBlockProcessorAddHandler
NetioFreeStackBlock
NetioInitializeNetBufferListAndFirstNetBufferContext
NsiReferenceDefaultObjectSecurity
NsiDeregisterChangeNotification
NsiRegisterChangeNotification
NetioCompleteNetBufferListChain
NetioAllocateAndReferenceFragmentNetBufferList
SetWfpDeviceObject
IoctlKfdBatchUpdate
IoctlKfdDeleteIndex
IoctlKfdAddIndex
IoctlKfdAddCache
IoctlKfdResetState
IoctlKfdQueryLayerStatistics
IoctlKfdAbortTransaction
IoctlKfdCommitTransaction
IoctlKfdDeleteCache
NetioGetStatsForQoSFlow
NetioDeleteQoSFlow
NetioCreateQoSFlow
NetioAssociateQoSFlowWithNbl
KfdIsActiveCallout
KfdAleUpdateEndpointContextStatus
WfpNblInfoAlloc
WfpPacketTagCountIncrement
WfpNblInfoDestroyIfUnused
HfCreateFactory
HfDestroyFactory
NetioAllocateNetBuffer
NetioAllocateAndReferenceNetBufferList
PtGetNumNodes
PtCreateTable
PtDestroyTable
NsiSetParameter
PtDeleteEntry
PtInsertEntry
PtGetExactMatch
PtEnumOverTable
PtGetLongestMatch
PtGetNextShorterMatch
RtlCompute37Hash
PtGetKey
PtSetData
PtGetData
NetioCompleteNetBufferAndNetBufferListChain
NetioQueryNetBufferListTrafficClass
RtlCopyMdlToMdl
NetioAllocateAndReferenceVacantNetBufferList
NetioAllocateAndReferenceCloneNetBufferListEx
NetioExpandNetBuffer
NetioUpdateNetBufferListContext
NetioAllocateAndReferenceCloneNetBufferList
NetioFreeCloneNetBufferList
NsiResetPersistentSetting
NsiSetObjectSecurity
NsiGetParameter
KfdCheckAcceptBypass
KfdCheckAndCacheAcceptBypass
KfdCheckConnectBypass
KfdCheckAndCacheConnectBypass
KfdGetLayerActionFromEnumTemplate
WfpScavangeLeastRecentlyUsedList
KfdAleRemoveFlowContextTable
WfpSetBucketsToEmptyLru
WfpExpireEntryLru
WfpInsertEntryLru
WfpDeleteEntryLru
KfdAleInitializeFlowTable
FeReleaseCalloutContextList
MatchCondition
KfdEnumLayer
KfdDerefFilterContext
KfdGetNextFilter
KfdFreeEnumHandle
KfdToggleFilterActivation
WfpStreamIsFilterPresent
NsiGetAllParameters
WfpInitializeLeastRecentlyUsedList
KfdAleNotifyFlowDeletion
FwppStreamDeleteDpcQueue
WfpUninitializeLeastRecentlyUsedList
KfdAleUninitializeFlowHandles
KfdAleInitializeFlowHandles
KfdGetOffloadEpoch
KfdIsLsoOffloadPossibleV6
KfdIsLsoOffloadPossibleV4
KfdIsV6InTransportFastEmpty
KfdIsV4InTransportFastEmpty
KfdIsV6OutTransportFastEmpty
KfdIsV4OutTransportFastEmpty
WfpRefreshEntryLru
NetioAdvanceNetBufferList
KfdCheckClassifyNeededAndUpdateEpoch
KfdAleAcquireFlowHandleForFlow
KfdClassify
KfdAleReleaseFlowHandleForFlow
KfdGetLayerCacheEpoch
KfdIsLayerEmpty
KfdDeregisterLayerChangeCallback
FwppStreamInject
FwppStreamContinue
FwppCopyStreamDataToBuffer
FwppAdvanceStreamDataPastOffset
FwppTruncateStreamDataAfterOffset
WfpNblInfoDispatchTableSet
KfdRegisterLayerChangeCallback
WfpNblInfoDispatchTableClear
FeGetWfpGlobalPtr
WfpNblInfoGet
NetioUnRegisterProcessorAddCallback
NetioUnInitializeNetBufferListLibrary
NetioInitializeNetBufferListLibrary
NetioRegisterProcessorAddCallback
NetioSqmInitialize
RtlInvokeStartRoutines
RtlInvokeStopRoutines
NetioSqmTerminate
NsiGetParameterEx
NetioAllocateAndInitializeStackBlock

ndis.sys

NdisInvalidateOffload
NdisUpdateOffload
NdisTerminateOffload
NdisInitiateOffload
NdisQueryOffloadState
NdisDirectOidRequest
NdisInitializeReadWriteLock
NdisGetSessionToCompartmentMappingEpochAndZero
NdisReleaseReadWriteLock
NdisAcquireReadWriteLock
NdisOffloadTcpSend
NdisOffloadTcpForward
NdisOffloadTcpDisconnect
NdisOffloadTcpReceive
NdisOffloadTcpReceiveReturn
NdisGetRssProcessorInformation
NdisCompleteNetPnPEvent
NdisCloseAdapterEx
NdisOpenAdapterEx
NdisOidRequest
NdisDeregisterProtocolDriver
NdisCancelDirectOidRequest
NdisCancelSendNetBufferLists
NdisSendNetBufferLists
NdisRegisterProtocolDriver
NdisReturnNetBufferLists
NdisSetOptionalHandlers
NdisGetDataBuffer
NetDmaRegisterClient
NetDmaDeregisterClient
NetDmaAllocateChannel
NetDmaFreeChannel
NdisGetProcessorInformation
NdisFreeNetBufferList
NetDmaNullTransfer
NetDmaIsDmaCopyComplete
NdisGetSessionCompartmentId
NdisAdjustNetBufferCurrentMdl
NdisGetThreadObjectCompartmentId
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart

fltmgr.sys

FltGetFileNameInformationUnsafe
FltReleaseFileNameInformation

fwpkclnt.sys

FwpsCalloutUnregisterByKey0
FwpmBfeStateSubscribeChangesWithoutDevice0
FwpmBfeStateUnsubscribeChanges0
FwpsClassifyOptionSet0
FwpmEngineClose0
FwpmEngineOpen0
FwpmSecureSocketDeleteByKeyAsync0
FwpmSecureSocketAddAsync0
FwpmEventProviderIsNetEventTypeEnabled0
FwpsRequestEndpointDeleteNotification0
FwpsForceReclassifyLayer0
FwpsCancelEndpointDeleteNotification0
FwppDispatchDevCtl0
IPsecDriverExpire
IPsecDriverInitiateAcquire
IPsecDriverProcessClearTextResponse
FwpsReassembleForwardFragmentGroup0
FwpsFreeNetBufferList0
FwpmEventProviderFireNetEvent0
FwpsQueryPacketInjectionState0
FwpsInjectionHandleDestroy0
FwpsInjectionHandleCreate0
FwpsAllocateCloneNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync1
FwpsFreeCloneNetBufferList0
FwpmEventProviderCreate0
FwpsTcpIpDispatchTableSet0
FwpsTcpIpDispatchTableClear0
FwpmEventProviderDestroy0
FwppNetBufferListEventNotify
FwpsCalloutRegisterWithoutDevice0

hal

KeGetCurrentIrql
KfLowerIrql
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryPerformanceCounter
KfReleaseSpinLock
KfAcquireSpinLock
KfRaiseIrql
ExReleaseFastMutex
ExAcquireFastMutex
KeRaiseIrqlToDpcLevel

ksecdd.sys

FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
QuerySecurityContextToken
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleW
BCryptHashData
BCryptGetProperty
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptFinishHash
BCryptGenRandom

msrpc.sys

NdrMesTypeDecode2
MesHandleFree
I_RpcExceptionFilter
MesDecodeBufferHandleCreate

Sections

.text
Size: 894KB - Virtual size: 894KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEIPSE
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEIDP
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGECONS
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b3d433b93a8e3b41e74295030727e94

Code Sign

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:03:05:56:00:00:00:00:00:10Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

0c:03:e5:26:d5:b4:b3:78:72:5d:f5:fe:7b:94:91:af:b5:c9:d0:f1Signer

Signature Validations

Verification

25/05/2011, 05:44 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

netio.sys

ndis.sys

fltmgr.sys

fwpkclnt.sys

hal

ksecdd.sys

msrpc.sys

Sections

.text Size: 894KB - Virtual size: 894KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 31KB - Virtual size: 78KB

PAGE Size: 9KB - Virtual size: 8KB

PAGEIPSE Size: 82KB - Virtual size: 81KB

PAGEIDP Size: 10KB - Virtual size: 9KB

PAGECONS Size: 512B - Virtual size: 120B

INIT Size: 19KB - Virtual size: 18KB

.rsrc Size: 132KB - Virtual size: 131KB

.reloc Size: 42KB - Virtual size: 41KB

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:03:05:56:00:00:00:00:00:10
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

0c:03:e5:26:d5:b4:b3:78:72:5d:f5:fe:7b:94:91:af:b5:c9:d0:f1
Signer

25/05/2011, 05:44
Valid: false

.text
Size: 894KB - Virtual size: 894KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 31KB - Virtual size: 78KB

PAGE
Size: 9KB - Virtual size: 8KB

PAGEIPSE
Size: 82KB - Virtual size: 81KB

PAGEIDP
Size: 10KB - Virtual size: 9KB

PAGECONS
Size: 512B - Virtual size: 120B

INIT
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 132KB - Virtual size: 131KB

.reloc
Size: 42KB - Virtual size: 41KB