bc14be8405b97425ce74a141ff0f49979a8aa42c12d007d721881e67e987f82c

Sharing

Copy URL Twitter E-mail

General

Target

bc14be8405b97425ce74a141ff0f49979a8aa42c12d007d721881e67e987f82c
Size

6.9MB
MD5

d182e029891f0e382447ae8049c7d0b4
SHA1

711dd609137550cdfa8440cfb7e864c62e328edb
SHA256

bc14be8405b97425ce74a141ff0f49979a8aa42c12d007d721881e67e987f82c
SHA512

63e55dfe47b3f9bc549ef44e82569205735636e9225ff8093b97ea6cb9b7d4153e4045703182c02e810bfb871dfd57633102292cb6e8eb40d38afcebd6703470
SSDEEP

196608:EDU7cZbn+9q3ey521NjdkBru+yXoEuJLb6KSDsuU:EDU7cFKNj+04EQ3hlF

Score

1^/10

Malware Config

Signatures

Files

bc14be8405b97425ce74a141ff0f49979a8aa42c12d007d721881e67e987f82c
.sys windows:10 windows x64

e3dee97d4282ee557745b88024839ce2

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20/05/2013, 00:00

Not After

20/05/2014, 23:59

Subject

CN=Shenzhen yundian Technology Co.\, Ltd,O=Shenzhen yundian Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4d
Signer

Actual PE Digest

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltObjectDereference

ndis.sys

NdisGetVersion

ksecdd.sys

SecLookupAccountSid

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.[}w
Size: - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sI:
Size: - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vlizer
Size: - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.`?]
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.*u1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uiM
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3dee97d4282ee557745b88024839ce2

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4dSigner

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ndis.sys

ksecdd.sys

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 469KB

.rdata Size: - Virtual size: 17KB

.data Size: - Virtual size: 56KB

.pdata Size: - Virtual size: 7KB

INIT Size: - Virtual size: 8KB

.[}w Size: - Virtual size: 768B

.sI: Size: - Virtual size: 72B

.vlizer Size: - Virtual size: 600KB

.`?] Size: - Virtual size: 5.5MB

.*u1 Size: 2KB - Virtual size: 2KB

.uiM Size: 6.9MB - Virtual size: 6.9MB

.reloc Size: 512B - Virtual size: 112B

.rsrc Size: 1024B - Virtual size: 760B

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4d
Signer

.text
Size: - Virtual size: 469KB

.rdata
Size: - Virtual size: 17KB

.data
Size: - Virtual size: 56KB

.pdata
Size: - Virtual size: 7KB

INIT
Size: - Virtual size: 8KB

.[}w
Size: - Virtual size: 768B

.sI:
Size: - Virtual size: 72B

.vlizer
Size: - Virtual size: 600KB

.`?]
Size: - Virtual size: 5.5MB

.*u1
Size: 2KB - Virtual size: 2KB

.uiM
Size: 6.9MB - Virtual size: 6.9MB

.reloc
Size: 512B - Virtual size: 112B

.rsrc
Size: 1024B - Virtual size: 760B