e1e0b887b68307ed192d393e886d8b982e4a2fd232ee13c2f20cd05f91358596[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target

e1e0b887b68307ed192d393e886d8b982e4a2fd232ee13c2f20cd05f91358596.bin.sample.gz
Size

22KB
MD5

5cf8f747a2206f102788cc37d8208931
SHA1

e345ee9594afc191bb0b918635ab349342e1f04f
SHA256

7251ff3212998d963446127015f33f66496a138c2e62731eb3a1658745386869
SHA512

870ffb48be1b403505a425a1f66db116a27e22786369ab1f2bbd1ed747254b8b72024af61d3849bb5b3cfa412606b17ec869c52a8a56d5193c5798577d97931d
SSDEEP

384:ZiCbK7YR8CKfuy4IuAOkkjePDauLE0/7uDm1Nf248CEcmg/j+:BgjT5vOkktuLE0zuKNrEcmg/S

Score

1^/10

Malware Config

Signatures

Files

e1e0b887b68307ed192d393e886d8b982e4a2fd232ee13c2f20cd05f91358596.bin.sample.gz
.gz
sample
.exe windows x64

915219c6d5e8ac411aaf1d602788058f

Code Sign

0f:78:74:64:ec:f2:aa:94:e0:4b:84:25:d4:de:5b:e4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/03/2012, 00:00

Not After

13/04/2015, 23:59

Subject

CN=Benq Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Technology Service Division,O=Benq Corporation,L=Taoyuan,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:a7:76:20:8f:81:f9:fb:36:19:d6:7e:48:91:8b:7c:6c:78:2b:86
Signer

Actual PE Digest

24:a7:76:20:8f:81:f9:fb:36:19:d6:7e:48:91:8b:7c:6c:78:2b:86

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Benq Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Technology Service Division,O=Benq Corporation,L=Taoyuan,ST=Taiwan,C=TW

27/02/2023, 09:30
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

MmUnmapLockedPages
IoFreeMdl
RtlUpcaseUnicodeChar
ZwOpenEvent
MmMapLockedPagesSpecifyCache
RtlEqualUnicodeString
IofCompleteRequest
IoGetDeviceObjectPointer
KeDelayExecutionThread
MmBuildMdlForNonPagedPool
IoAllocateMdl
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenDirectoryObject
RtlInitUnicodeString
MmIsAddressValid
NtBuildNumber
ExFreePoolWithTag
IoCreateSynchronizationEvent
ExAllocatePool

ndis.sys

NdisCopyFromNetBufferToNetBuffer
NdisAllocateNetBufferMdlAndData
NdisAllocateNetBufferList
NdisSendNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMemoryWithTag
NdisFreeMdl
NdisFreeNetBufferList
NdisReturnNetBufferLists
NdisGetVersion
NdisFreeNetBufferListPool
NdisFreeNetBufferPool
NdisDeregisterProtocolDriver
NdisRegisterProtocolDriver
NdisAllocateNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeMemory
NdisFreeNetBuffer

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

915219c6d5e8ac411aaf1d602788058f

Code Sign

0f:78:74:64:ec:f2:aa:94:e0:4b:84:25:d4:de:5b:e4Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

24:a7:76:20:8f:81:f9:fb:36:19:d6:7e:48:91:8b:7c:6c:78:2b:86Signer

Signature Validations

Verification

27/02/2023, 09:30 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

ndis.sys

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 6KB

.pdata Size: 512B - Virtual size: 432B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 848B

0f:78:74:64:ec:f2:aa:94:e0:4b:84:25:d4:de:5b:e4
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

24:a7:76:20:8f:81:f9:fb:36:19:d6:7e:48:91:8b:7c:6c:78:2b:86
Signer

27/02/2023, 09:30
Valid: false

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 6KB

.pdata
Size: 512B - Virtual size: 432B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 848B