872931d2992d4e657cb0939e02827b5e6dd744e7d45671331fd281fddb6f04ab

Sharing

Copy URL Twitter E-mail

General

Target

872931d2992d4e657cb0939e02827b5e6dd744e7d45671331fd281fddb6f04ab
Size

5.1MB
MD5

69018ed452bb6d0fc3452a523afac64e
SHA1

e2e663a5a492373caa84b4ad2caa15222a9367c0
SHA256

872931d2992d4e657cb0939e02827b5e6dd744e7d45671331fd281fddb6f04ab
SHA512

4171d4417d5287b7750e38f2ccb656ad9bac4c93dd6808d3d71874baf9c090ee94c0c662dd2d2435dbbdeab5375235bb41d46e7527bc3aed42b90cf93dae29dc
SSDEEP

98304:HtiRsEFwujWO/H04VZwhXSaTFtSYgLEXfwf13LOFsvDq+M:YRXtjWSzVZwhXSyA94X45OuDq3

Score

1^/10

Malware Config

Signatures

Files

872931d2992d4e657cb0939e02827b5e6dd744e7d45671331fd281fddb6f04ab
.exe windows x64

3bf17df88af4d2fe330ec7e591dbed0b

Code Sign

10:10:d6:35:de:1a:66:92:0d:aa:cc:3a:ef:c7:f1:a2
Certificate

Issuer

CN=Certera Code Signing CA,O=Certera,C=US

Not Before

08/05/2023, 00:00

Not After

07/05/2024, 23:59

Subject

CN=黄胤彰,O=黄胤彰,ST=广西壮族自治区,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

21:66:f0:8a:51:eb:fc:ab:cc:8f:44:30:91:a9:4b:0e
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

07/09/2022, 00:00

Not After

06/09/2032, 23:59

Subject

CN=Certera Code Signing CA,O=Certera,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:51:2f:c7:c7:aa:c3:0b
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA1 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2002, 00:00

Not After

20/09/2052, 23:59

Subject

CN=DigiCert Timestamp 2023 - 1,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

39:85:0d:35:b4:f3:d8:9b
Certificate

Issuer

CN=DigiCert Assured ID Root CA - G2,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/05/2000, 00:00

Not After

07/05/2060, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA1 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:03:d5:41:86:38:65:3e:d0:3c:4c:e6:bc:0a:c0:e9:39:14:bc:fc
Signer

Actual PE Digest

98:03:d5:41:86:38:65:3e:d0:3c:4c:e6:bc:0a:c0:e9:39:14:bc:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.FXY
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.D6z
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.@@0
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3bf17df88af4d2fe330ec7e591dbed0b

Code Sign

10:10:d6:35:de:1a:66:92:0d:aa:cc:3a:ef:c7:f1:a2Certificate

Extended Key Usages

Key Usages

21:66:f0:8a:51:eb:fc:ab:cc:8f:44:30:91:a9:4b:0eCertificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

78:51:2f:c7:c7:aa:c3:0bCertificate

Extended Key Usages

Key Usages

39:85:0d:35:b4:f3:d8:9bCertificate

Extended Key Usages

Key Usages

98:03:d5:41:86:38:65:3e:d0:3c:4c:e6:bc:0a:c0:e9:39:14:bc:fcSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 5KB

.rdata Size: - Virtual size: 1KB

.data Size: - Virtual size: 120B

.pdata Size: - Virtual size: 276B

INIT Size: - Virtual size: 1KB

.FXY Size: - Virtual size: 2.8MB

.D6z Size: 1024B - Virtual size: 584B

.@@0 Size: 5.1MB - Virtual size: 5.1MB

.reloc Size: 512B - Virtual size: 268B

10:10:d6:35:de:1a:66:92:0d:aa:cc:3a:ef:c7:f1:a2
Certificate

21:66:f0:8a:51:eb:fc:ab:cc:8f:44:30:91:a9:4b:0e
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

78:51:2f:c7:c7:aa:c3:0b
Certificate

39:85:0d:35:b4:f3:d8:9b
Certificate

98:03:d5:41:86:38:65:3e:d0:3c:4c:e6:bc:0a:c0:e9:39:14:bc:fc
Signer

.text
Size: - Virtual size: 5KB

.rdata
Size: - Virtual size: 1KB

.data
Size: - Virtual size: 120B

.pdata
Size: - Virtual size: 276B

INIT
Size: - Virtual size: 1KB

.FXY
Size: - Virtual size: 2.8MB

.D6z
Size: 1024B - Virtual size: 584B

.@@0
Size: 5.1MB - Virtual size: 5.1MB

.reloc
Size: 512B - Virtual size: 268B