Fingerprint_ELAN_Win10_64_VER45100110202[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Fingerprint_ELAN_Win10_64_VER45100110202.zip
Size

1.3MB
MD5

8c489d4718ebaee0150d18e4a5fb6702
SHA1

ff07be4f08e6e30dedbb61396c71df171106b7f8
SHA256

a0ed7284ea2a81112d7f75df89d99d8c4dfaf7a583094690bea6d99325c89fb0
SHA512

b8d99ef0d7efa8495b2c8447699e0389dfd4abc48f7e84ec6d4b36070e1dd128bcda3c4099aaa031aedb94d7b9d4e7283163173904b532a5b9659e93bfb3cace
SSDEEP

24576:tpN5MqjXWSqmkElgy1blAD3ZhjGHnFJPNuIyylrajZiIHp4rFIldOeeprcAyRlW9:tSQXRvlgyxlAZJ0nFJAPylruHeibOe3q

Score

1^/10

Malware Config

Signatures

Files

Fingerprint_ELAN_Win10_64_VER45100110202.zip
.zip
EngineAdapter.dll
.dll windows x64

f1719c81dfd605a51659556caa70128e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:8f:c5:1d:6c:ee:40:96:de:30:28:d2:4b:94:e1:60
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/05/2015, 00:00

Not After

14/05/2018, 23:59

Subject

SERIALNUMBER=84149224,CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Paoshan Hsiang,ST=Hsinchu,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130654616977616e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:0c:dc:09:63:02:ac:c2:f7:f6:2d:84:2a:1e:d9:6b:53:54:58:71:d1:8d:69:6d:61:d2:c2:9d:0f:16:c7:b4
Signer

Actual PE Digest

eb:0c:dc:09:63:02:ac:c2:f7:f6:2d:84:2a:1e:d9:6b:53:54:58:71:d1:8d:69:6d:61:d2:c2:9d:0f:16:c7:b4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

07/02/2023, 20:39
Valid: false

98:05:e1:fa:fa:34:f4:bb:67:0e:13:2b:29:44:5e:60:eb:f0:36:b9
Signer

Actual PE Digest

98:05:e1:fa:fa:34:f4:bb:67:0e:13:2b:29:44:5e:60:eb:f0:36:b9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=84149224,CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Paoshan Hsiang,ST=Hsinchu,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130654616977616e,1.3.6.1.4.1.311.60.2.1.3=#13025457

16/03/2018, 06:19
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
fread
ftell
fseek
fclose
fwrite
fopen
__stdio_common_vswprintf
__stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

strcpy
memset
strcmp
strlen
strcpy_s
wcscat_s
strncpy

api-ms-win-crt-heap-l1-1-0

_calloc_base
calloc
_malloc_base
_callnewh
malloc
free
_free_base

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
abort
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_at_quick_exit
_initterm_e
_initterm

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsGetValue
FlsFree
FlsAlloc

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-crt-convert-l1-1-0

atol

Exports

Exports

WbioQueryEngineInterface

Sections

.text
Size: 827KB - Virtual size: 827KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 330KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_i
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_r
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_s
Size: 512B - Virtual size: 147B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_f
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Setup.bat
WbfSpiDriver.dll
.dll windows x64

efb9a6db18e4b2b686cc481ed39d3ae4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:8f:c5:1d:6c:ee:40:96:de:30:28:d2:4b:94:e1:60
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/05/2015, 00:00

Not After

14/05/2018, 23:59

Subject

SERIALNUMBER=84149224,CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Paoshan Hsiang,ST=Hsinchu,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130654616977616e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:ce:40:b7:6e:d4:2f:73:0a:44:a2:96:02:d6:1f:c4:7c:a0:f5:64:3b:e0:67:eb:95:98:45:f1:fc:56:32:27
Signer

Actual PE Digest

6a:ce:40:b7:6e:d4:2f:73:0a:44:a2:96:02:d6:1f:c4:7c:a0:f5:64:3b:e0:67:eb:95:98:45:f1:fc:56:32:27

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

07/02/2023, 20:39
Valid: false

aa:96:17:82:65:41:7c:5b:e1:28:23:28:b5:c5:4f:be:35:89:24:0b
Signer

Actual PE Digest

aa:96:17:82:65:41:7c:5b:e1:28:23:28:b5:c5:4f:be:35:89:24:0b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=84149224,CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Paoshan Hsiang,ST=Hsinchu,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130654616977616e,1.3.6.1.4.1.311.60.2.1.3=#13025457

16/03/2018, 06:19
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlUnwindEx
RtlPcToFileHeader
DbgPrintEx
RtlInitUnicodeString
VerSetConditionMask

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

OpenEventW
ResetEvent
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
CreateEventW
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
CreateThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetLocalTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-file-l1-1-0

CreateFileW

hid

HidD_GetAttributes
HidP_GetCaps
HidD_SetFeature
HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetHidGuid
HidP_GetValueCaps

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-crt-string-l1-1-0

wcscpy_s
strcpy_s
memset
strcpy
strlen
strcmp

api-ms-win-crt-heap-l1-1-0

calloc
_free_base
malloc
free
_callnewh
_calloc_base

api-ms-win-crt-stdio-l1-1-0

fwrite
__stdio_common_vswprintf
fclose
fseek
ftell
fread
fopen

api-ms-win-crt-utility-l1-1-0

qsort

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsAlloc
FlsGetValue

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_seh_filter_dll
_execute_onexit_table
_initterm_e
_initialize_onexit_table
_initialize_narrow_environment
_initterm
_cexit
_crt_atexit
_configure_narrow_argv

Exports

Exports

FxDriverEntryUm

Sections

.text
Size: 799KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 354KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata.u
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata.u
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_i
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_r
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_s
Size: 512B - Virtual size: 147B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_f
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WbfSpiDriver.inf
item.txt
pnputil.exe
.exe windows x64

e2484bfda138da7f1fb72346766b38e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

wcsrchr
memmove
_resetstkoflw
_vsnprintf
toupper
swprintf_s
memcmp
memcpy
memset
wcstoul
_ultow_s
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcschr
__C_specific_handler
_wcsnicmp
_wcsicmp
_vsnwprintf
wcscmp

api-ms-win-core-file-l1-1-0

CreateFileW
FindNextFileW
FindFirstFileW
WriteFile
FindClose
GetFileAttributesW
GetTempFileNameW
DeleteFileW
SetFileAttributesW
SetFilePointer
GetFileInformationByHandle
CreateFileA
RemoveDirectoryW
CreateDirectoryW
SetEndOfFile
DeleteFileA
GetFileSize
ReadFile
FlushFileBuffers
FileTimeToLocalFileTime
GetFullPathNameW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
GetLastError
SetLastError

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetStdHandle
GetCommandLineA

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW
CM_Get_Sibling
CM_Open_Class_KeyW
CM_Get_DevNode_PropertyW
CM_Get_Child
CM_Get_Device_ID_ListW
CM_Get_Device_Interface_ListW
CM_Get_Parent
CM_Get_Class_PropertyW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_IDW
CM_Locate_DevNodeW
CM_MapCrToWin32Err

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadPreferredUILanguages
LCMapStringW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetSystemFirmwareTable

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
GetModuleHandleW
LoadStringW
LoadLibraryExA
GetModuleFileNameA

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount64
GetSystemWindowsDirectoryW
GetLocalTime
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegUnLoadKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSaveKeyExW
RegSetValueExW
RegCloseKey
RegDeleteKeyExW
RegLoadKeyW
RegLoadAppKeyW
RegCreateKeyExW
RegOpenKeyExW
RegFlushKey
RegQueryValueExW
RegRestoreKeyW

ntdll

RtlGetVersion
NtQuerySystemInformation
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
NtSetInformationFile
NtQueryInformationFile
RtlImageNtHeader
RtlRandomEx
RtlGUIDFromString
RtlFormatCurrentUserKeyPath
NtClose
NtDeleteKey
NtOpenKey
NtCreateKey
NtQueryValueKey
NtSetValueKey
NtEnumerateKey
RtlGetSaclSecurityDescriptor
RtlAllocateHeap
RtlInitializeSRWLock
RtlFreeHeap
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlValidRelativeSecurityDescriptor
RtlLengthSecurityDescriptor
RtlInitUnicodeStringEx
RtlUnicodeStringToInteger
NtOpenThreadToken
NtOpenProcessToken
NtQuerySecurityObject
NtDuplicateToken
NtAdjustPrivilegesToken
RtlLengthSid
RtlCopySid
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtEnumerateValueKey
NtDeleteValueKey
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtQueryInformationToken
RtlEqualSid
RtlConvertSidToUnicodeString
RtlAppendUnicodeStringToString
RtlAddAccessAllowedAceEx
RtlValidSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
LdrGetDllHandle
RtlInitAnsiString
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlTimeToTimeFields
RtlGetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlValidSid
RtlSubAuthoritySid
RtlInitializeSid
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
LdrUnloadDll
LdrGetProcedureAddress
LdrLoadDll
NtUnloadKey2
RtlInitUnicodeString
NtQueryKey
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
NtSetInformationThread

api-ms-win-core-registry-l2-1-0

RegSaveKeyW
RegDeleteKeyW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l2-1-2

CopyFileW

cabinet

ord12
ord14
ord10
ord13
ord11

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
SetThreadToken
OpenProcessToken

api-ms-win-core-file-l1-2-2

GetTempPathA
GetTempFileNameA

api-ms-win-core-kernel32-legacy-l1-1-0

FileTimeToDosDateTime

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
DuplicateTokenEx
GetKernelObjectSecurity

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-rtlsupport-l1-1-0

RtlCompareMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

drvstore

DriverStoreCopyW
DriverStoreEnumObjectsW
DriverStoreDeleteW
DriverStoreUpdateDevicesW
DriverStoreGetObjectPropertyW
DriverPackageGetVersionInfoW
DriverStoreSetLogContext
DriverStoreImportW
DriverStoreFindW
DriverPackageOpenW
DriverStoreEnumW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
SetEvent

api-ms-win-service-management-l1-1-0

CloseServiceHandle

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualProtect
VirtualQuery
CreateFileMappingW
MapViewOfFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-sddl-l1-1-0

ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-file-l2-1-0

CreateHardLinkW
MoveFileExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wbfspidriver.cat

Sharing

General

Malware Config

Signatures

Files

f1719c81dfd605a51659556caa70128e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

3f:8f:c5:1d:6c:ee:40:96:de:30:28:d2:4b:94:e1:60Certificate

Extended Key Usages

Key Usages

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

eb:0c:dc:09:63:02:ac:c2:f7:f6:2d:84:2a:1e:d9:6b:53:54:58:71:d1:8d:69:6d:61:d2:c2:9d:0f:16:c7:b4Signer

Signature Validations

Verification

07/02/2023, 20:39 Valid: false

98:05:e1:fa:fa:34:f4:bb:67:0e:13:2b:29:44:5e:60:eb:f0:36:b9Signer

Signature Validations

Verification

16/03/2018, 06:19 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 827KB - Virtual size: 827KB

.text.un Size: 512B - Virtual size: 160B

.text.un Size: 1024B - Virtual size: 640B

.text.un Size: 2KB - Virtual size: 1KB

.text.un Size: 512B - Virtual size: 384B

.text.un Size: 512B - Virtual size: 112B

.text.un Size: 512B - Virtual size: 288B

.text.un Size: 512B - Virtual size: 480B

.text.un Size: 512B - Virtual size: 112B

.text.un Size: 1024B - Virtual size: 960B

.text.un Size: 512B - Virtual size: 80B

.text.un Size: 512B - Virtual size: 176B

.text.un Size: 1KB - Virtual size: 1KB

.text.un Size: 512B - Virtual size: 384B

.text.un Size: 3KB - Virtual size: 3KB

.rdata Size: 330KB - Virtual size: 329KB

.data Size: 3KB - Virtual size: 34KB

.pdata Size: 18KB - Virtual size: 17KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

3f:8f:c5:1d:6c:ee:40:96:de:30:28:d2:4b:94:e1:60
Certificate

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

eb:0c:dc:09:63:02:ac:c2:f7:f6:2d:84:2a:1e:d9:6b:53:54:58:71:d1:8d:69:6d:61:d2:c2:9d:0f:16:c7:b4
Signer

07/02/2023, 20:39
Valid: false

98:05:e1:fa:fa:34:f4:bb:67:0e:13:2b:29:44:5e:60:eb:f0:36:b9
Signer

16/03/2018, 06:19
Valid: false

.text
Size: 827KB - Virtual size: 827KB

.text.un
Size: 512B - Virtual size: 160B

.text.un
Size: 1024B - Virtual size: 640B

.text.un
Size: 2KB - Virtual size: 1KB

.text.un
Size: 512B - Virtual size: 384B

.text.un
Size: 512B - Virtual size: 112B

.text.un
Size: 512B - Virtual size: 288B

.text.un
Size: 512B - Virtual size: 480B

.text.un
Size: 512B - Virtual size: 112B

.text.un
Size: 1024B - Virtual size: 960B

.text.un
Size: 512B - Virtual size: 80B

.text.un
Size: 512B - Virtual size: 176B

.text.un
Size: 1KB - Virtual size: 1KB

.text.un
Size: 512B - Virtual size: 384B

.text.un
Size: 3KB - Virtual size: 3KB

.rdata
Size: 330KB - Virtual size: 329KB

.data
Size: 3KB - Virtual size: 34KB

.pdata
Size: 18KB - Virtual size: 17KB

.xdata.u
Size: 512B - Virtual size: 16B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 48B

.pdata.u
Size: 512B - Virtual size: 24B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 8B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 4B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 48B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 4B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 16B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.xdata.u
Size: 512B - Virtual size: 24B

.pdata.u
Size: 512B - Virtual size: 12B

.gfids
Size: 512B - Virtual size: 224B

.debug_i
Size: 43KB - Virtual size: 42KB

.debug_a
Size: 2KB - Virtual size: 1KB

.debug_l
Size: 217KB - Virtual size: 217KB

.debug_a
Size: 512B - Virtual size: 384B

.debug_r
Size: 3KB - Virtual size: 3KB

.debug_l
Size: 23KB - Virtual size: 23KB

.debug_s
Size: 512B - Virtual size: 147B

.debug_f
Size: 1024B - Virtual size: 960B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 39KB - Virtual size: 38KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

3f:8f:c5:1d:6c:ee:40:96:de:30:28:d2:4b:94:e1:60
Certificate

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

6a:ce:40:b7:6e:d4:2f:73:0a:44:a2:96:02:d6:1f:c4:7c:a0:f5:64:3b:e0:67:eb:95:98:45:f1:fc:56:32:27
Signer

07/02/2023, 20:39
Valid: false

aa:96:17:82:65:41:7c:5b:e1:28:23:28:b5:c5:4f:be:35:89:24:0b
Signer

16/03/2018, 06:19
Valid: false