069849c7b9e1efe5c006a7becb0dcf4420ada3b008617ce80b38adbb52163e23

Sharing

Copy URL Twitter E-mail

General

Target

069849c7b9e1efe5c006a7becb0dcf4420ada3b008617ce80b38adbb52163e23
Size

41KB
MD5

ead91c8dfc4226ce791cf9b8520855f9
SHA1

be310ba8d845c7065efb3d90f4c8627673199978
SHA256

069849c7b9e1efe5c006a7becb0dcf4420ada3b008617ce80b38adbb52163e23
SHA512

528a701c0410dc4464cf018698a48b21d5746d9bc98bb23b3a8d161a184400b33fc5208e747cfe48f013140908b5065b7e1618536e8c0df8471e90b61959e9a2
SSDEEP

768:clKqqyhV8Ajkxya3dKgDTkY7TIUODfjeng2wmcW8YmK:clTqyhVJIxZDhZODA1cRtK

Score

1^/10

Malware Config

Signatures

Files

069849c7b9e1efe5c006a7becb0dcf4420ada3b008617ce80b38adbb52163e23
.exe windows x64

000d3a73dc4a7a9e2bcb090e666fb22a

Code Sign

05:3b:82:0e:2a:18:a9:57:1f:2a:87:68:c6:6c:76:02
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/10/2019, 00:00

Not After

01/11/2021, 12:00

Subject

CN=方正科技集团股份有限公司,O=方正科技集团股份有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:5d:8c:4f:4e:05:28:2d:d2:a9:a5:89:e9:25:6d:a7
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/10/2019, 00:00

Not After

01/11/2021, 12:00

Subject

CN=方正科技集团股份有限公司,O=方正科技集团股份有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:b0:3c:31:6c:07:9a:7c:79:28:57:15:73:7a:1a:de:cd:d3:20:ad:e1:41:1e:72:71:fb:19:bd:40:bc:2a:22
Signer

Actual PE Digest

da:b0:3c:31:6c:07:9a:7c:79:28:57:15:73:7a:1a:de:cd:d3:20:ad:e1:41:1e:72:71:fb:19:bd:40:bc:2a:22

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=方正科技集团股份有限公司,O=方正科技集团股份有限公司,ST=上海市,C=CN

03/05/2023, 12:08
Valid: false

9b:30:47:04:be:fd:a0:2c:0a:c1:83:f8:de:58:c4:93:2c:a4:d8:f0
Signer

Actual PE Digest

9b:30:47:04:be:fd:a0:2c:0a:c1:83:f8:de:58:c4:93:2c:a4:d8:f0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=方正科技集团股份有限公司,O=方正科技集团股份有限公司,ST=上海市,C=CN

03/05/2023, 12:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePool
_vsnwprintf
DbgPrintEx
SeCreateAccessState
IoFreeIrp
IoGetFileObjectGenericMapping
ObfDereferenceObject
RtlInitUnicodeString
ObCreateObject
IoFileObjectType
KeSetEvent
ObReferenceObjectByHandle
IoFreeMdl
wcsstr
IoCreateFile
MmGetSystemRoutineAddress
IoAllocateIrp
IofCallDriver
ExFreePoolWithTag
strstr
KeInitializeEvent
KeWaitForSingleObject
ZwClose

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

000d3a73dc4a7a9e2bcb090e666fb22a

Code Sign

05:3b:82:0e:2a:18:a9:57:1f:2a:87:68:c6:6c:76:02Certificate

Extended Key Usages

Key Usages

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

0c:5d:8c:4f:4e:05:28:2d:d2:a9:a5:89:e9:25:6d:a7Certificate

Extended Key Usages

Key Usages

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate

Extended Key Usages

Key Usages

da:b0:3c:31:6c:07:9a:7c:79:28:57:15:73:7a:1a:de:cd:d3:20:ad:e1:41:1e:72:71:fb:19:bd:40:bc:2a:22Signer

Signature Validations

Verification

03/05/2023, 12:08 Valid: false

9b:30:47:04:be:fd:a0:2c:0a:c1:83:f8:de:58:c4:93:2c:a4:d8:f0Signer

Signature Validations

Verification

03/05/2023, 12:08 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 336B

INIT Size: 1024B - Virtual size: 668B

05:3b:82:0e:2a:18:a9:57:1f:2a:87:68:c6:6c:76:02
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

0c:5d:8c:4f:4e:05:28:2d:d2:a9:a5:89:e9:25:6d:a7
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

da:b0:3c:31:6c:07:9a:7c:79:28:57:15:73:7a:1a:de:cd:d3:20:ad:e1:41:1e:72:71:fb:19:bd:40:bc:2a:22
Signer

03/05/2023, 12:08
Valid: false

9b:30:47:04:be:fd:a0:2c:0a:c1:83:f8:de:58:c4:93:2c:a4:d8:f0
Signer

03/05/2023, 12:08
Valid: false

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 336B

INIT
Size: 1024B - Virtual size: 668B