drv64[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

drv64.sys
Size

11KB
MD5

3ad8f21d5fd350870deecca4d0014226
SHA1

68c850e6f00d17d7d57ad5f99091ab28863b894d
SHA256

305618e5cab84793035525bd84230ae0f1840a63dc5cd0ce2616f524c4c97644
SHA512

54df343221dfa538aa8e36d35e9c1b464c307223f9259de95a6b796fcd2daf2fa9e7832b6d3107d9feaed809bf5b1796986371c17ce8b3cc32a7cff99c810286
SSDEEP

192:Ya5vWgVrkXh8nSFou7+wiz78n9MFnAvlBXd/N547cgoMa7riKdVg4D:L5OXs/uY82FclB5N2BKLg4D

Score

1^/10

Malware Config

Signatures

Files

drv64.sys
.exe windows x64

232dd480206c58c5441768474d572bd5

Code Sign

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

17/01/2014, 00:00

Not After

17/01/2016, 23:59

Subject

CN=Binzhoushi Yongyu Feed Co.\,LTd.,O=Binzhoushi Yongyu Feed Co.\,LTd.,L=Binzhou,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

Issuer

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5:7e:79:68:96
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:32:4a:05:57:ce:f1:f5:b2:23:bc:f1:18:de:66:99:1e:0e:3c:7b
Signer

Actual PE Digest

29:32:4a:05:57:ce:f1:f5:b2:23:bc:f1:18:de:66:99:1e:0e:3c:7b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Binzhoushi Yongyu Feed Co.\,LTd.,O=Binzhoushi Yongyu Feed Co.\,LTd.,L=Binzhou,ST=Shandong,C=CN

01/01/2015, 09:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
RtlInitUnicodeString
ZwClose
ZwOpenProcess
ZwTerminateProcess

Sections

.text
Size: 576B - Virtual size: 574B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 320B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

232dd480206c58c5441768474d572bd5

Code Sign

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6Certificate

Extended Key Usages

Key Usages

1e:b1:32:d5Certificate

Key Usages

1e:b1:32:d5:7e:79:68:96Certificate

Extended Key Usages

Key Usages

29:32:4a:05:57:ce:f1:f5:b2:23:bc:f1:18:de:66:99:1e:0e:3c:7bSigner

Signature Validations

Verification

01/01/2015, 09:12 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 576B - Virtual size: 574B

.rdata Size: 288B - Virtual size: 288B

.data Size: 192B - Virtual size: 188B

INIT Size: 320B - Virtual size: 312B

.reloc Size: 32B - Virtual size: 28B

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Certificate

1e:b1:32:d5
Certificate

1e:b1:32:d5:7e:79:68:96
Certificate

29:32:4a:05:57:ce:f1:f5:b2:23:bc:f1:18:de:66:99:1e:0e:3c:7b
Signer

01/01/2015, 09:12
Valid: false

.text
Size: 576B - Virtual size: 574B

.rdata
Size: 288B - Virtual size: 288B

.data
Size: 192B - Virtual size: 188B

INIT
Size: 320B - Virtual size: 312B

.reloc
Size: 32B - Virtual size: 28B