1cb5a52fed6fb216bfbc36a7fe83492a7b7c6c5976675fb7a508a5acf920a54e

Sharing

Copy URL Twitter E-mail

General

Target

1cb5a52fed6fb216bfbc36a7fe83492a7b7c6c5976675fb7a508a5acf920a54e
Size

3.3MB
MD5

4e24051425ca82e09df8813e41cf380c
SHA1

e4bb8e6515e859de53b92105a9d2f69b8b5a176d
SHA256

1cb5a52fed6fb216bfbc36a7fe83492a7b7c6c5976675fb7a508a5acf920a54e
SHA512

988d70a68f058a4b06a593a53d01f937f071d1435d53ae6248a5b9e170f5e2c7eb152d0cd043b0462725abba5a5194237b72da1d06de5bc4e6f604bcbd8271ea
SSDEEP

49152:765oGExe/Os3fSe3tz/oSUE2XEFN2QKPomdk9U78/Q5CUM75Sdb4akSKEs/7U+g+:7BG3y2AXtFH3Y4NM7U9CMtA4i

Score

1^/10

Malware Config

Signatures

Files

1cb5a52fed6fb216bfbc36a7fe83492a7b7c6c5976675fb7a508a5acf920a54e
.exe windows x64

2f9fa9113f8473617cdae2385fc5f8c7

Code Sign

5d:2c:19:bb:f0:03:d2:c1:fc:40:72:ed:99:37:b2:87
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

14/07/2016, 07:23

Not After

14/08/2017, 07:23

Subject

CN=杭州诸相网络科技有限公司,O=杭州诸相网络科技有限公司,L=杭州市,ST=浙江省,C=CN,1.2.840.113549.1.9.1=#0c126875616e677765694078756265692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:63:a8:76:00:c3:b4:63:db:a2:14:a6:28:01:0a:16:e9:74:27:66
Signer

Actual PE Digest

8c:63:a8:76:00:c3:b4:63:db:a2:14:a6:28:01:0a:16:e9:74:27:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltRegisterFilter

ntoskrnl.exe

ExAllocatePoolWithTag
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.txsb0
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.txsb1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f9fa9113f8473617cdae2385fc5f8c7

Code Sign

5d:2c:19:bb:f0:03:d2:c1:fc:40:72:ed:99:37:b2:87Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

8c:63:a8:76:00:c3:b4:63:db:a2:14:a6:28:01:0a:16:e9:74:27:66Signer

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

hal

Sections

.text Size: 174KB - Virtual size: 173KB

.rdata Size: 426KB - Virtual size: 425KB

.data Size: 2KB - Virtual size: 17KB

.pdata Size: 10KB - Virtual size: 10KB

.gfids Size: 512B - Virtual size: 4B

PAGE Size: 6KB - Virtual size: 6KB

INIT Size: 30KB - Virtual size: 30KB

.txsb0 Size: 1.2MB - Virtual size: 1.2MB

.txsb1 Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 1024B - Virtual size: 796B

.rsrc Size: 1024B - Virtual size: 848B

5d:2c:19:bb:f0:03:d2:c1:fc:40:72:ed:99:37:b2:87
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

19:c2:85:30:e9:3b:36
Certificate

8c:63:a8:76:00:c3:b4:63:db:a2:14:a6:28:01:0a:16:e9:74:27:66
Signer

.text
Size: 174KB - Virtual size: 173KB

.rdata
Size: 426KB - Virtual size: 425KB

.data
Size: 2KB - Virtual size: 17KB

.pdata
Size: 10KB - Virtual size: 10KB

.gfids
Size: 512B - Virtual size: 4B

PAGE
Size: 6KB - Virtual size: 6KB

INIT
Size: 30KB - Virtual size: 30KB

.txsb0
Size: 1.2MB - Virtual size: 1.2MB

.txsb1
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 1024B - Virtual size: 796B

.rsrc
Size: 1024B - Virtual size: 848B