d92abd5d5c8eaad41b8e9ff4d677c7b7938328574030394e01df53e25d6e1ad1

Sharing

Copy URL Twitter E-mail

General

Target

d92abd5d5c8eaad41b8e9ff4d677c7b7938328574030394e01df53e25d6e1ad1
Size

5.1MB
MD5

c33c368e2af01f9ea85c0e056f3b7993
SHA1

4dea802a5996cb9023270c50925426d74773bc63
SHA256

d92abd5d5c8eaad41b8e9ff4d677c7b7938328574030394e01df53e25d6e1ad1
SHA512

b6ed30cb535562ea49d488208c47c1e2e90db2dd30c2d7f8313202b4a4e993408dab25437116a73b0feb543c00638783a1a44acfc5aa64ff184bebd344072248
SSDEEP

98304:4GntOTNzICgjIH6zvfzr/hTLyY2MXHUH0KWu8E:4Gt2bgkHEffEY2G0UKWu8E

Score

1^/10

Malware Config

Signatures

Files

d92abd5d5c8eaad41b8e9ff4d677c7b7938328574030394e01df53e25d6e1ad1
.exe windows x64

91190aa88d9c7fe625aed3b7f920ae18

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20/05/2013, 00:00

Not After

20/05/2014, 23:59

Subject

CN=Shenzhen yundian Technology Co.\, Ltd,O=Shenzhen yundian Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2005, 13:46

Not After

01/11/2025, 13:54

Subject

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

06:fd:03:4c:ab:a6:21:56:02:93:a9:25:77:27:8e:0f:06:35:e2:f2
Signer

Actual PE Digest

06:fd:03:4c:ab:a6:21:56:02:93:a9:25:77:27:8e:0f:06:35:e2:f2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

cng.sys

BCryptGenRandom

ntoskrnl.exe

RtlInitUnicodeString
ZwClose
RtlInitAnsiString
RtlDeleteRegistryValue
RtlAppendUnicodeToString
DbgPrint
ExAllocatePool
ExFreePoolWithTag
MmGetSystemRoutineAddress
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
ZwOpenKey
ZwDeleteKey
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlCompareString
MmIsAddressValid
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
RtlPcToFileHeader
RtlImageNtHeader
IoFileObjectType
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
__C_specific_handler
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePoolWithTag
MmFreeContiguousMemory
RtlImageDirectoryEntryToData
RtlUnicodeToMultiByteN
KeBugCheckEx
_stricmp
NtQuerySystemInformation
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwWaitForSingleObject
ZwDeviceIoControlFile
ZwOpenFile
_wcsnicmp
ZwEnumerateKey
ZwCreateEvent
MmGetSystemRoutineAddress
ZwCreateFile
__C_specific_handler
KeSetSystemAffinityThread
KeQueryActiveProcessors
KeQueryTimeIncrement
DbgBreakPointWithStatus
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoAllocateMdl
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
ExFreePoolWithTag
ExAllocatePool
KeRevertToUserAffinityThread
DbgPrint
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Cc0
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91190aa88d9c7fe625aed3b7f920ae18

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38Certificate

Key Usages

06:fd:03:4c:ab:a6:21:56:02:93:a9:25:77:27:8e:0f:06:35:e2:f2Signer

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

cng.sys

ntoskrnl.exe

hal

Sections

.text Size: 334KB - Virtual size: 334KB

.rdata Size: 214KB - Virtual size: 214KB

.data Size: 1KB - Virtual size: 15KB

.pdata Size: 13KB - Virtual size: 12KB

INIT Size: 2KB - Virtual size: 1KB

.Cc0 Size: 2.9MB - Virtual size: 2.9MB

.Cc1 Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 3KB - Virtual size: 2KB

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38
Certificate

06:fd:03:4c:ab:a6:21:56:02:93:a9:25:77:27:8e:0f:06:35:e2:f2
Signer

.text
Size: 334KB - Virtual size: 334KB

.rdata
Size: 214KB - Virtual size: 214KB

.data
Size: 1KB - Virtual size: 15KB

.pdata
Size: 13KB - Virtual size: 12KB

INIT
Size: 2KB - Virtual size: 1KB

.Cc0
Size: 2.9MB - Virtual size: 2.9MB

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 3KB - Virtual size: 2KB