hvix64[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hvix64.exe
Size

1.2MB
MD5

3d39cca75a75fa49e02e03f41aee286b
SHA1

09dc824b7beaa508480178e6af3665f29b21bb1c
SHA256

a42a3828a4ae13f330981c0ba50b51f627f6a12a29d934bb81913f7e59e5b983
SHA512

962ef2a355691c778ad0ba24988bd23b1f84087a45bc06be82d4a8fb5b1108628064118c20cad42540cf0c9059a9384202152ced5804bd70f2b051b63c00b5c7
SSDEEP

24576:JmF8gjUrTqM+6pl1U3GrHw1QRv0Nxo0O5J01iVjo+YkO7BoIzO+Yhmq:cuv5pRrHKGvWxDOv02eH7+V

Score

1^/10

Malware Config

Signatures

Files

hvix64.exe
.exe windows x64

d5aec1c1f764856cfb4155cee3321234

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:89:fa:3b:0f:e6:b9:ae:e0:80:10:02:97:d4:54:c2:74:14:e9:6f:ce:a4:ec:2d:ed:4e:52:02:76:12:21:28
Signer

Actual PE Digest

73:89:fa:3b:0f:e6:b9:ae:e0:80:10:02:97:d4:54:c2:74:14:e9:6f:ce:a4:ec:2d:ed:4e:52:02:76:12:21:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kdstub

KdInitializeLibrary

Exports

Exports

HvImageInfo
VmxBootInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 911KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 106B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CONST
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

LOWMEM
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 95B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

GFIDS
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5aec1c1f764856cfb4155cee3321234

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

73:89:fa:3b:0f:e6:b9:ae:e0:80:10:02:97:d4:54:c2:74:14:e9:6f:ce:a4:ec:2d:ed:4e:52:02:76:12:21:28Signer

Headers

DLL Characteristics

File Characteristics

Imports

kdstub

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 78KB - Virtual size: 77KB

.data Size: 26KB - Virtual size: 911KB

.pdata Size: 46KB - Virtual size: 46KB

.idata Size: 512B - Virtual size: 106B

CONST Size: 5KB - Virtual size: 5KB

LOWMEM Size: 512B - Virtual size: 44B

.edata Size: 512B - Virtual size: 95B

GFIDS Size: 4KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

73:89:fa:3b:0f:e6:b9:ae:e0:80:10:02:97:d4:54:c2:74:14:e9:6f:ce:a4:ec:2d:ed:4e:52:02:76:12:21:28
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 78KB - Virtual size: 77KB

.data
Size: 26KB - Virtual size: 911KB

.pdata
Size: 46KB - Virtual size: 46KB

.idata
Size: 512B - Virtual size: 106B

CONST
Size: 5KB - Virtual size: 5KB

LOWMEM
Size: 512B - Virtual size: 44B

.edata
Size: 512B - Virtual size: 95B

GFIDS
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 2KB - Virtual size: 1KB