9241ef91b438f640fffa490bba0faa48

Sharing

Copy URL Twitter E-mail

General

Target

9241ef91b438f640fffa490bba0faa48
Size

772KB
MD5

9241ef91b438f640fffa490bba0faa48
SHA1

c73b4bf262410d197da64d35428a9796c486b9d4
SHA256

3971036d3beaabd168334f64e182d5393a37f7f236ca983cc29f6c2f6d15107b
SHA512

4171f8a5479fa34242cafda6dcb5688729c4192711399c6ebfa02f15559f5c0cab34ad2be3581b82ee933bce225bb4461a9c8138efeda73ab64c8d62a3b55414
SSDEEP

12288:ie1IK9HlJ70VbWee8qw5oASJgoudip5SFx3LFfZtIEAj6UHkyIFMp/jkYawjagrY:igR9HjAcp8uASPX+FxVAukoYatgmbYg

Score

1^/10

Malware Config

Signatures

Files

9241ef91b438f640fffa490bba0faa48
.exe windows x64

2bba728e941f5e951e453fa82a9ad485

Code Sign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:0a:bf:4c:1c:9c:6d:62:a5:ef:e1:d1:22:fc:d4:1f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/12/2012, 00:00

Not After

07/12/2013, 23:59

Subject

CN=BEIJING WANXIANGBOZHONG SYSTEM INTEGRATION CO.\, LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING WANXIANGBOZHONG SYSTEM INTEGRATION CO.\, LTD,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:6d:bd:42:57:b0:39:0f:25:cc:c8:fa:6b:37:b7:51:2b:ca:af:8d
Signer

Actual PE Digest

9f:6d:bd:42:57:b0:39:0f:25:cc:c8:fa:6b:37:b7:51:2b:ca:af:8d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BEIJING WANXIANGBOZHONG SYSTEM INTEGRATION CO.\, LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING WANXIANGBOZHONG SYSTEM INTEGRATION CO.\, LTD,L=Beijing,ST=Beijing,C=CN

07/02/2023, 20:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlGetVersion
ZwCreateFile
ZwClose
RtlCopyUnicodeString
DbgPrint
ExAllocatePool
ExFreePoolWithTag
ExInitializeNPagedLookasideList
PsCreateSystemThread
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoGetCurrentProcess
IoRegisterShutdownNotification
MmIsAddressValid
PsSetLoadImageNotifyRoutine
_snwprintf
_strlwr
RtlInitAnsiString
RtlQueryRegistryValues
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
ZwOpenKey
ZwQueryValueKey
strstr
_strupr
wcsncat
wcsncmp
wcsncpy
wcsrchr
wcsstr
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlTimeToTimeFields
KeInitializeEvent
KeDelayExecutionThread
KeWaitForSingleObject
ExSystemTimeToLocalTime
PsGetVersion
IofCompleteRequest
ZwQueryInformationFile
ZwReadFile
ZwWriteFile
sprintf
swprintf
rand
srand
ZwDeleteFile
ProbeForRead
PsTerminateSystemThread
ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExDeleteNPagedLookasideList
strncpy
_vsnprintf
ExAllocatePoolWithTag
RtlInitString
ZwOpenFile
ZwCreateSection
ZwMapViewOfSection
RtlCompareString
PsGetCurrentProcessId
PsLookupProcessByProcessId
RtlImageNtHeader
PsGetProcessPeb
__C_specific_handler
strchr
_wcsupr
RtlWriteRegistryValue
RtlDeleteRegistryValue
RtlAppendUnicodeStringToString
ZwCreateKey
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
atoi
mbstowcs
_strnicmp
strrchr
ZwSetInformationFile
strncmp
_snprintf
KeSetEvent
ObfReferenceObject
MmProbeAndLockPages
IoAllocateIrp
IoAllocateMdl
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoFreeMdl
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
RtlCompareUnicodeString
MmGetSystemRoutineAddress
IoCreateFile
IoGetFileObjectGenericMapping
ObQueryNameString
ZwOpenDirectoryObject
ObCreateObject
SeCreateAccessState
wcscmp
IoFileObjectType
PsThreadType
RtlAppendUnicodeToString
RtlCompareMemory
IoUnregisterShutdownNotification
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx
ZwOpenProcess
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
ZwQueryDirectoryFile
_wcsicmp
_wcslwr
IoGetDeviceObjectPointer
IoStopTimer
PsRemoveLoadImageNotifyRoutine
IoGetDeviceAttachmentBaseRef
_stricmp
NtOpenProcess
ZwQueryObject
ZwDuplicateObject
PsLookupThreadByThreadId
ZwOpenThread
ZwUnmapViewOfSection
KeStackAttachProcess
KeUnstackDetachProcess
ZwAllocateVirtualMemory
PsIsThreadTerminating
KeInitializeApc
KeInsertQueueApc
CmRegisterCallback
CmUnRegisterCallback
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeClearEvent
KeBugCheckEx
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeCancelTimer
KeNumberProcessors
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation

hal

HalMakeBeep

Sections

.text
Size: - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vvd0
Size: - Virtual size: 545KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vvd1
Size: 765KB - Virtual size: 765KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bba728e941f5e951e453fa82a9ad485

Code Sign

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

1b:0a:bf:4c:1c:9c:6d:62:a5:ef:e1:d1:22:fc:d4:1fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

9f:6d:bd:42:57:b0:39:0f:25:cc:c8:fa:6b:37:b7:51:2b:ca:af:8dSigner

Signature Validations

Verification

07/02/2023, 20:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 165KB

.rdata Size: - Virtual size: 13KB

.data Size: - Virtual size: 154KB

.pdata Size: - Virtual size: 5KB

INIT Size: - Virtual size: 4KB

.vvd0 Size: - Virtual size: 545KB

.vvd1 Size: 765KB - Virtual size: 765KB

.reloc Size: 512B - Virtual size: 40B

61:19:93:e4:00:00:00:00:00:1c
Certificate

1b:0a:bf:4c:1c:9c:6d:62:a5:ef:e1:d1:22:fc:d4:1f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

9f:6d:bd:42:57:b0:39:0f:25:cc:c8:fa:6b:37:b7:51:2b:ca:af:8d
Signer

07/02/2023, 20:39
Valid: false

.text
Size: - Virtual size: 165KB

.rdata
Size: - Virtual size: 13KB

.data
Size: - Virtual size: 154KB

.pdata
Size: - Virtual size: 5KB

INIT
Size: - Virtual size: 4KB

.vvd0
Size: - Virtual size: 545KB

.vvd1
Size: 765KB - Virtual size: 765KB

.reloc
Size: 512B - Virtual size: 40B