7e6e2ed880c7ab115fca68136051f9ce[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

7e6e2ed880c7ab115fca68136051f9ce.bin
Size

20KB
MD5

7e6e2ed880c7ab115fca68136051f9ce
SHA1

3cd037fbba8aae82c1b111c9f8755349c98bcb3c
SHA256

175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347
SHA512

5400f5c3687c441caa53236650808ee18b6d14d06e95bc0adb8a6dde18deea41bc23b4b6c06643c62210a5d3bbd67ffadb3f280eff09e963f6eb006bee716598
SSDEEP

192:zAUlERTxMNZ3/b0B/XNkrEc+PbZbI+nM2iAp5UEwQl/WGhYCCBuXqnajg4SaU:zAU5NZ3/w1kMNLnpzlnh3CYlE44

Score

1^/10

Malware Config

Signatures

Files

7e6e2ed880c7ab115fca68136051f9ce.bin
.exe windows x64

f3d931c54cb8800c7643b40f608d1344

Code Sign

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:31

Not After

05/03/2021, 17:31

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:5e:57:74:ae:fd:74:20:0d:55:2b:f7:ed:e1:74:91:c2:54:fa:7a:73:e2:a0:0e:b0:e1:46:2f:18:21:1f:f5
Signer

Actual PE Digest

79:5e:57:74:ae:fd:74:20:0d:55:2b:f7:ed:e1:74:91:c2:54:fa:7a:73:e2:a0:0e:b0:e1:46:2f:18:21:1f:f5

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/03/2023, 18:28
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

cng.sys

BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptDecrypt
BCryptImportKey
BCryptDestroyKey
BCryptSetProperty
BCryptOpenAlgorithmProvider

ntoskrnl.exe

IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
wcsstr
ObfDereferenceObject
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetCurrentProcessId
RtlTimeToSecondsSince1970
__C_specific_handler
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlInitUnicodeString
KeBugCheckEx
ObReferenceObjectByHandle

hal

HalTranslateBusAddress

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3d931c54cb8800c7643b40f608d1344

Code Sign

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3aCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

79:5e:57:74:ae:fd:74:20:0d:55:2b:f7:ed:e1:74:91:c2:54:fa:7a:73:e2:a0:0e:b0:e1:46:2f:18:21:1f:f5Signer

Signature Validations

Verification

27/03/2023, 18:28 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

cng.sys

ntoskrnl.exe

hal

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 32B

.pdata Size: 512B - Virtual size: 384B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

79:5e:57:74:ae:fd:74:20:0d:55:2b:f7:ed:e1:74:91:c2:54:fa:7a:73:e2:a0:0e:b0:e1:46:2f:18:21:1f:f5
Signer

27/03/2023, 18:28
Valid: false

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 32B

.pdata
Size: 512B - Virtual size: 384B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B