hvix64[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

hvix64.exe
Size

1.5MB
MD5

e4b67c6713b6742bae48cd8ced891a09
SHA1

1f8f111c5af16d1a31f1eee5b5e3c95fdfd66691
SHA256

1c4c824a5f2c88e7970006a8120a507032af659d1b347d9eb2d8add711d2950d
SHA512

a18019917f44f7675a4ab88d2bf58467f22bcc7a7a87d2d7fa949156a398c98a418a46a0d9dd017453f822f2a2cd1236ae42755c58d4fda76c0c2f5017c47cb8
SSDEEP

24576:LI1xq1Pns6sOpB+FNawoNvTfCbiKaNnCw10GjEjyY3Gz5VsJah1yXGg/xoI2:ZnroYT10GAzi52Jazop/Ox

Score

1^/10

Malware Config

Signatures

Files

hvix64.exe
.exe windows x64

d5aec1c1f764856cfb4155cee3321234

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:35:c2:ca:91:98:1a:ef:44:ae:1e:ea:e2:c2:c8:64:95:14:42:f1:79:54:c0:95:3a:3b:0a:13:59:c0:8f:1d
Signer

Actual PE Digest

21:35:c2:ca:91:98:1a:ef:44:ae:1e:ea:e2:c2:c8:64:95:14:42:f1:79:54:c0:95:3a:3b:0a:13:59:c0:8f:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kdstub

KdInitializeLibrary

Exports

Exports

HvImageInfo
VmxBootInfo

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 106B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CONST
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 95B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

GFIDS
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5aec1c1f764856cfb4155cee3321234

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

21:35:c2:ca:91:98:1a:ef:44:ae:1e:ea:e2:c2:c8:64:95:14:42:f1:79:54:c0:95:3a:3b:0a:13:59:c0:8f:1dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kdstub

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 94KB - Virtual size: 94KB

.data Size: 34KB - Virtual size: 1.9MB

.pdata Size: 59KB - Virtual size: 59KB

.idata Size: 512B - Virtual size: 106B

CONST Size: 6KB - Virtual size: 6KB

.edata Size: 512B - Virtual size: 95B

GFIDS Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

21:35:c2:ca:91:98:1a:ef:44:ae:1e:ea:e2:c2:c8:64:95:14:42:f1:79:54:c0:95:3a:3b:0a:13:59:c0:8f:1d
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 34KB - Virtual size: 1.9MB

.pdata
Size: 59KB - Virtual size: 59KB

.idata
Size: 512B - Virtual size: 106B

CONST
Size: 6KB - Virtual size: 6KB

.edata
Size: 512B - Virtual size: 95B

GFIDS
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 2KB - Virtual size: 1KB