ba99b45daea2b9681d983e557850a46e1a20a7715e28d67a6722afb43883f672

Sharing

Copy URL Twitter E-mail

General

Target

ba99b45daea2b9681d983e557850a46e1a20a7715e28d67a6722afb43883f672
Size

19KB
MD5

fc36d242d6f4edadadc5a0ca085c51f6
SHA1

6ac71f2f7918463a5e7abf533b8c16460afce8c9
SHA256

ba99b45daea2b9681d983e557850a46e1a20a7715e28d67a6722afb43883f672
SHA512

586df381cea5e9880f7abe131e778fc36eea199af56259af7158602d509ea774d82e819b42fa6f7cf82fb311211be6fdd9addbc83a196ed800e3a672dcc9d851
SSDEEP

384:HzY2VgI1RrKzBsWEUwWxHyG6FuT+quHpBjfOjBML37:HzlVgI1gz8tBxgMn

Score

N/A

Malware Config

Signatures

Files

ba99b45daea2b9681d983e557850a46e1a20a7715e28d67a6722afb43883f672
.exe windows x86

303c65bcd9f1158f3d59ab42242a5598

Code Sign

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:01:e1:a1:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/12/2008, 22:12

Not After

12/03/2010, 22:22

Subject

CN=Microsoft Windows,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

09/05/2001, 23:19

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

30:ec:f5:32:f3:24:36:92:03:9a:42:e1:94:cf:20:81:8d:34:68:0e
Signer

Actual PE Digest

30:ec:f5:32:f3:24:36:92:03:9a:42:e1:94:cf:20:81:8d:34:68:0e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/02/2009, 05:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ataport.sys

AtaPortNotification
AtaPortWritePortUchar
AtaPortWritePortUlong
AtaPortGetPhysicalAddress
AtaPortConvertPhysicalAddressToUlong
AtaPortGetScatterGatherList
AtaPortReadPortUchar
AtaPortStallExecution
AtaPortGetParentBusType
AtaPortRequestCallback
AtaPortWritePortBufferUshort
AtaPortGetUnCachedExtension
AtaPortCompleteRequest
AtaPortMoveMemory
AtaPortCompleteAllActiveRequests
AtaPortReleaseRequestSenseIrb
AtaPortBuildRequestSenseIrb
AtaPortReadPortUshort
AtaPortReadPortBufferUshort
AtaPortInitialize
AtaPortGetDeviceBase
AtaPortDeviceStateChange

ntoskrnl.exe

KeTickCount

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

303c65bcd9f1158f3d59ab42242a5598

Code Sign

61:04:ca:69:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:01:e1:a1:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

30:ec:f5:32:f3:24:36:92:03:9a:42:e1:94:cf:20:81:8d:34:68:0eSigner

Signature Validations

Verification

12/02/2009, 05:44 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ataport.sys

ntoskrnl.exe

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 512B - Virtual size: 174B

.data Size: 512B - Virtual size: 12B

INIT Size: 1024B - Virtual size: 868B

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 512B - Virtual size: 138B

61:04:ca:69:00:00:00:00:00:08
Certificate

61:01:e1:a1:00:00:00:00:00:08
Certificate

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

30:ec:f5:32:f3:24:36:92:03:9a:42:e1:94:cf:20:81:8d:34:68:0e
Signer

12/02/2009, 05:44
Valid: false

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 512B - Virtual size: 174B

.data
Size: 512B - Virtual size: 12B

INIT
Size: 1024B - Virtual size: 868B

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 512B - Virtual size: 138B