a2c38035183bd2377ed4baec12f239b676db2431e140236fc2b8b35a3996e122
- IMPHASH 28871e7fd41b875456d7742efbec7703
- SHA256 a2c38035183bd2377ed4baec12f239b676db2431e140236fc2b8b35a3996e122
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
PE Signature issue
Digest
f4:24:79:74:a0:a1:f8:d1:32:06:0b:5e:f4:79:f7:d7:25:28:ba:51:31:b3:2a:23:a8:4b:54:8e:4d:78:ec:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Subject
CN=David Miller Root CA - R4,O=David Miller Trust Services,C=CN
Serial Number
47:8b:c1:86:22:c0:70:29:63:1b:cc:39:df:a3:2a:8b
Issuer
CN=David Miller Root CA - R4,O=David Miller Trust Services,C=CN
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 4, 2023 - Jan 3, 2053
Subject
SERIALNUMBER=7777897613,CN=David Miller,O=David Miller Trust Services,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
2a:bf:b4:c0:32:66:50:70:cd:21:7c:b5:ed:69:7f:9b
Issuer
CN=David Miller Code Signing CA - G3 - SHA384,OU=For authorized use only,O=David Miller Trust Services,C=CN
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 15, 2023 - Apr 14, 2024
Subject
CN=David Miller Code Signing CA - G3 - SHA384,OU=For authorized use only,O=David Miller Trust Services,C=CN
Serial Number
0e:39:48:f9:bc:a0:29:eb:ef:2b:b1:2a:a9:3e:5b:32
Issuer
CN=David Miller Root CA - R4,O=David Miller Trust Services,C=CN
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 12, 2023 - Apr 11, 2033
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
Major OS version
Entry point
189200
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
335KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
117KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
818KB
Virtual Size
818KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ