192ef0dee8df73eec9ee617abe4b0104799f9543a22a41e28d4d44c3ad713284[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target

192ef0dee8df73eec9ee617abe4b0104799f9543a22a41e28d4d44c3ad713284.bin.sample.gz
Size

39KB
MD5

0a0818b65641a1bc69598b2502ac5822
SHA1

3a3c13b704dbe9d6e5381538f79d7c9c90bc59df
SHA256

f2fdfdb0779ea07d5a3a89ca20116fa851f95b33695b349637cc4fefe57622f7
SHA512

087dee9fd7801247bf17042808c118f619dc466528ebacc71e79f375b787202d7c7dd31483045024e159a1cdb940d35cf9e01df650ad5da3b8b1263320c07853
SSDEEP

768:+fhf9ozikYw7rhcCMdahoICS4AI27tt3QOTZyoA/b:+o1Yw7rHEICS4A5t3QUyoA/b

Score

1^/10

Malware Config

Signatures

Files

192ef0dee8df73eec9ee617abe4b0104799f9543a22a41e28d4d44c3ad713284.bin.sample.gz
.gz
sample
.exe windows x64

fa6080f835381755e2778e32bca4f6bf

Code Sign

0f:78:74:64:ec:f2:aa:94:e0:4b:84:25:d4:de:5b:e4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/03/2012, 00:00

Not After

13/04/2015, 23:59

Subject

CN=Benq Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Technology Service Division,O=Benq Corporation,L=Taoyuan,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a1:a7:1f:2c:3a:91:34:b3:17:7a:2c:8f:96:c1:53:7f:a7:09:37:ce
Signer

Actual PE Digest

a1:a7:1f:2c:3a:91:34:b3:17:7a:2c:8f:96:c1:53:7f:a7:09:37:ce

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Benq Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Technology Service Division,O=Benq Corporation,L=Taoyuan,ST=Taiwan,C=TW

27/02/2023, 09:32
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

MmUnmapLockedPages
IoFreeMdl
RtlUpcaseUnicodeChar
ZwOpenEvent
IoCreateSynchronizationEvent
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoGetDeviceObjectPointer
ProbeForRead
ProbeForWrite
KeDelayExecutionThread
MmBuildMdlForNonPagedPool
IoAllocateMdl
ExAllocatePoolWithTag
ExFreePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenDirectoryObject
RtlInitUnicodeString
NtBuildNumber
MmIsAddressValid
RtlEqualUnicodeString
__C_specific_handler

ndis.sys

NdisCopyFromNetBufferToNetBuffer
NdisAllocateNetBufferMdlAndData
NdisAllocateNetBufferList
NdisSendNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMemoryWithTag
NdisFreeMdl
NdisFreeNetBufferList
NdisReturnNetBufferLists
NdisGetVersion
NdisFreeNetBufferListPool
NdisFreeNetBufferPool
NdisDeregisterProtocolDriver
NdisRegisterProtocolDriver
NdisAllocateNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeMemory
NdisFreeNetBuffer

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa6080f835381755e2778e32bca4f6bf

Code Sign

0f:78:74:64:ec:f2:aa:94:e0:4b:84:25:d4:de:5b:e4Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

a1:a7:1f:2c:3a:91:34:b3:17:7a:2c:8f:96:c1:53:7f:a7:09:37:ceSigner

Signature Validations

Verification

27/02/2023, 09:32 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

ndis.sys

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 664B

.pdata Size: 1KB - Virtual size: 1KB

INIT Size: 2KB - Virtual size: 1KB

0f:78:74:64:ec:f2:aa:94:e0:4b:84:25:d4:de:5b:e4
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a1:a7:1f:2c:3a:91:34:b3:17:7a:2c:8f:96:c1:53:7f:a7:09:37:ce
Signer

27/02/2023, 09:32
Valid: false

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 664B

.pdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 1KB