ImDisk virtual disk driver 2[.]0[.]10[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ImDisk virtual disk driver 2.0.10.exe
Size

561KB
MD5

dc90372cb0fe139520b04929041102ac
SHA1

8e518efea4930b626e1b038f560565ef7ebfc2a4
SHA256

1e5291ad53e8b90f88882eeef791e8b5f162aef020e55a633cec4d1581acce4e
SHA512

d750a7358f45b771c7c4cd11391f772356125adfa8e6bcccab72fbc8672a45c4f63510a5b55abd62ac20143280f1900d733b4dbff97f122f5a09a523af68122d
SSDEEP

12288:HRQsjCLmZvTRV5vJrEKsT+L5/uV7hRROf1sLvj/wb:xj3bdsq5/uxbRcibj/4

Score

1^/10

Malware Config

Signatures

Files

ImDisk virtual disk driver 2.0.10.exe
.exe windows x86

43d031fee4fabbf224448cfe01b59e8a

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:31:89:c6:4d:e1
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:21:01:0f:f2:71:77:94:5c:4e:36:c5:fc:7a:4c:98:78:8a
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/02/2016, 16:22

Not After

10/02/2019, 15:13

Subject

SERIALNUMBER=969697-0400,CN=Lagerkvist Teknisk Rådgivning i Borås HB,O=Lagerkvist Teknisk Rådgivning i Borås HB,STREET=Alvestagatan 29 lgh 1502,L=Borås,ST=Västra Götalands Län,C=SE,1.3.6.1.4.1.311.60.2.1.3=#13025345,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

32:09:10:cb:23:31:e1:f2:07:54:21:98:41:e5:38:67:0f:b1:55:0a
Signer

Actual PE Digest

32:09:10:cb:23:31:e1:f2:07:54:21:98:41:e5:38:67:0f:b1:55:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

KillTimer
SendMessageA
GetDlgItem
SetTimer
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
GetWindowLongA
SetWindowTextW
SetWindowTextA
LoadStringW
LoadStringA
CharUpperW
CharUpperA
DestroyWindow
EndDialog
PostMessageA
ShowWindow
MessageBoxW

oleaut32

VariantClear
SysAllocString

shell32

ShellExecuteExA

comctl32

ord17

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
memcpy
free
malloc
_CxxThrowException
_purecall
memmove
__CxxFrameHandler
memcmp

kernel32

GetModuleHandleA
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventA
VirtualFree
VirtualAlloc
WaitForMultipleObjects
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetStartupInfoA
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
GetTempFileNameA
GetTempPathA
GetCurrentDirectoryA
GetFullPathNameW
GetFullPathNameA
LeaveCriticalSection
DeleteFileW
DeleteFileA
CreateDirectoryW
CreateDirectoryA
RemoveDirectoryW
SetFileAttributesW
RemoveDirectoryA
SetFileAttributesA
CreateFileW
SetFileTime
GetWindowsDirectoryA
FormatMessageW
FormatMessageA
LocalFree
GetModuleFileNameW
GetModuleFileNameA
AreFileApisANSI
WaitForSingleObject
CloseHandle
CreateProcessA
SetCurrentDirectoryA
GetCommandLineW
GetVersionExA
lstrlenA
EnterCriticalSection
Sleep
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43d031fee4fabbf224448cfe01b59e8a

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

04:00:00:00:00:01:31:89:c6:4d:e1Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

11:21:01:0f:f2:71:77:94:5c:4e:36:c5:fc:7a:4c:98:78:8aCertificate

Extended Key Usages

Key Usages

32:09:10:cb:23:31:e1:f2:07:54:21:98:41:e5:38:67:0f:b1:55:0aSigner

Headers

File Characteristics

Imports

user32

oleaut32

shell32

comctl32

msvcrt

kernel32

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 3KB - Virtual size: 2KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

04:00:00:00:00:01:31:89:c6:4d:e1
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

11:21:01:0f:f2:71:77:94:5c:4e:36:c5:fc:7a:4c:98:78:8a
Certificate

32:09:10:cb:23:31:e1:f2:07:54:21:98:41:e5:38:67:0f:b1:55:0a
Signer

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 3KB - Virtual size: 2KB