easy_Benign_ffc38f945060f7639f7356a5ef904846e78a4a77aaa5421e2f360e9413f75392[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

easy_Benign_ffc38f945060f7639f7356a5ef904846e78a4a77aaa5421e2f360e9413f75392.exe
Size

21KB
MD5

7feabd719943b84881915f08f497db59
SHA1

c92419c73471dc161a2cff96f1044fce46dec266
SHA256

ffc38f945060f7639f7356a5ef904846e78a4a77aaa5421e2f360e9413f75392
SHA512

2d7946637e0378a57a7a015178bd1deeaa719151a5fc30ba08f61acd10adce9f0277439e7987525f55fb23dd5f222e05f84d8fd5bfb603cf472d00f6f498c2ce
SSDEEP

384:nXZjUrqyq7praXEjFmJwofkW0HWQmXjDBRJ4gXlqN:JQGyqtAmQ+2CSXj1P4f

Score

1^/10

Malware Config

Signatures

Files

easy_Benign_ffc38f945060f7639f7356a5ef904846e78a4a77aaa5421e2f360e9413f75392.exe
.exe windows x64

3c356b75a2fee34f32ed8f3663d250c0

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:e2:01:cf:ea:34:3b:6c:e6:52:2c:15:59:d5:0d:d3:1b:a6:9a:de:a2:a1:eb:6a:ed:16:70:d1:1b:51:23:7f
Signer

Actual PE Digest

6c:e2:01:cf:ea:34:3b:6c:e6:52:2c:15:59:d5:0d:d3:1b:a6:9a:de:a2:a1:eb:6a:ed:16:70:d1:1b:51:23:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ZwSetSystemInformation
RtlCopyUnicodeString
MmMapIoSpaceEx
ProbeForWrite
MmUnmapIoSpace
__C_specific_handler
ExGetPreviousMode

wdfldr.sys

WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 173B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c356b75a2fee34f32ed8f3663d250c0

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

6c:e2:01:cf:ea:34:3b:6c:e6:52:2c:15:59:d5:0d:d3:1b:a6:9a:de:a2:a1:eb:6a:ed:16:70:d1:1b:51:23:7fSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 216B

.idata Size: 1024B - Virtual size: 544B

PAGE Size: 3KB - Virtual size: 3KB

INIT Size: 512B - Virtual size: 173B

GFIDS Size: 512B - Virtual size: 44B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 284B

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

6c:e2:01:cf:ea:34:3b:6c:e6:52:2c:15:59:d5:0d:d3:1b:a6:9a:de:a2:a1:eb:6a:ed:16:70:d1:1b:51:23:7f
Signer

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 216B

.idata
Size: 1024B - Virtual size: 544B

PAGE
Size: 3KB - Virtual size: 3KB

INIT
Size: 512B - Virtual size: 173B

GFIDS
Size: 512B - Virtual size: 44B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 284B