471025fe2aa8624218cef5bb08f5f0cb0b428cf1528e3aebeee8066773416424

Sharing

Copy URL

Twitter E-mail

General

Target

471025fe2aa8624218cef5bb08f5f0cb0b428cf1528e3aebeee8066773416424
Size

3.3MB
MD5

0f8b7aea4fea87897f43c62c6e3f9d67
SHA1

94f886174859001c18910ced15d50c6a7f3ed873
SHA256

471025fe2aa8624218cef5bb08f5f0cb0b428cf1528e3aebeee8066773416424
SHA512

5e61fb2e28fe861d248420281e5fb92d6787d412d7e30dc9074ade4c6500e8bcd2a1db3cd9e816d9b47e75157901ec20f9c1a6e5fb1ad2569b7193c410afc5a9
SSDEEP

49152:5fkE5wa0vN/7uSFbbdD4nD/+bmfER1S+BeJgLmEwmo9u/11xlg93PLz72oEXkXIC:5fL0uiTWJ1KSzI7+gQ

Score

1^/10

Malware Config

Signatures

Files

471025fe2aa8624218cef5bb08f5f0cb0b428cf1528e3aebeee8066773416424
.exe windows x64

2f9fa9113f8473617cdae2385fc5f8c7

Code Sign

5d:2c:19:bb:f0:03:d2:c1:fc:40:72:ed:99:37:b2:87
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

14/07/2016, 07:23

Not After

14/08/2017, 07:23

Subject

CN=杭州诸相网络科技有限公司,O=杭州诸相网络科技有限公司,L=杭州市,ST=浙江省,C=CN,1.2.840.113549.1.9.1=#0c126875616e677765694078756265692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:c1:d8:35:06:c8:fb:7c:83:45:22:e1:80:0c:9c:e1:26:4b:d9:2a
Signer

Actual PE Digest

42:c1:d8:35:06:c8:fb:7c:83:45:22:e1:80:0c:9c:e1:26:4b:d9:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltRegisterFilter

ntoskrnl.exe

ExAllocatePoolWithTag
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.txsb0
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.txsb1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f9fa9113f8473617cdae2385fc5f8c7

Code Sign

5d:2c:19:bb:f0:03:d2:c1:fc:40:72:ed:99:37:b2:87Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

42:c1:d8:35:06:c8:fb:7c:83:45:22:e1:80:0c:9c:e1:26:4b:d9:2aSigner

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

hal

Sections

.text Size: 162KB - Virtual size: 162KB

.rdata Size: 420KB - Virtual size: 420KB

.data Size: 2KB - Virtual size: 17KB

.pdata Size: 9KB - Virtual size: 9KB

.gfids Size: 512B - Virtual size: 4B

PAGE Size: 6KB - Virtual size: 6KB

INIT Size: 28KB - Virtual size: 28KB

.txsb0 Size: 1.2MB - Virtual size: 1.2MB

.txsb1 Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 1024B - Virtual size: 788B

.rsrc Size: 1024B - Virtual size: 848B

5d:2c:19:bb:f0:03:d2:c1:fc:40:72:ed:99:37:b2:87
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

19:c2:85:30:e9:3b:36
Certificate

42:c1:d8:35:06:c8:fb:7c:83:45:22:e1:80:0c:9c:e1:26:4b:d9:2a
Signer

.text
Size: 162KB - Virtual size: 162KB

.rdata
Size: 420KB - Virtual size: 420KB

.data
Size: 2KB - Virtual size: 17KB

.pdata
Size: 9KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 4B

PAGE
Size: 6KB - Virtual size: 6KB

INIT
Size: 28KB - Virtual size: 28KB

.txsb0
Size: 1.2MB - Virtual size: 1.2MB

.txsb1
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 1024B - Virtual size: 788B

.rsrc
Size: 1024B - Virtual size: 848B