be30c96473263d27434c20d429321b47722deea4c08b76b0e6270da587201110

Sharing

Copy URL Twitter E-mail

General

Target

be30c96473263d27434c20d429321b47722deea4c08b76b0e6270da587201110
Size

9KB
MD5

26cb82ebae952c9ae9757b07a1333b7a
SHA1

0e4e5fe8ef9c110e1d33e8fa6d0e1beb1729b5a4
SHA256

be30c96473263d27434c20d429321b47722deea4c08b76b0e6270da587201110
SHA512

569439f1b54a8d453b32b0edaea9565ed67bfc97568928ff03e686aa9ff76f68fdaf412e4507805a207636e3eeb7bf2804c2764d1e780b1d2a94b3f3f758bab8
SSDEEP

192:zX6O/a2VDM8SuTLGgnJFhsQLezlvY8bMpdsnQbefsPziQrsjKm:7vaaY8vLFJFCgQvY8opdUhfkPrst

Score

1^/10

Malware Config

Signatures

Files

be30c96473263d27434c20d429321b47722deea4c08b76b0e6270da587201110
.zip
prestartport.sys
.sys windows:6 windows x86

bf0820e6583a1b085646c650db8667e5

Code Sign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:e0:ba:ad:a0:7c:44:61:1f:f7:ab:81:21:0b:17
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2020, 00:00

Not After

22/02/2023, 12:00

Subject

CN=RUIJIE NETWORKS CO.\, LTD,OU=Network Products Research,O=RUIJIE NETWORKS CO.\, LTD,L=福州市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:f9:b0:fe:f4:fa:7d:6f:19:e6:a1:e4:ed:7a:c3:0e
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2020, 00:00

Not After

22/02/2023, 12:00

Subject

CN=RUIJIE NETWORKS CO.\, LTD,OU=Network Products Research,O=RUIJIE NETWORKS CO.\, LTD,L=福州市,ST=福建省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:4e:ca:37:80:45:ca:49:80:3c:35:e1:e9:d1:9b:0b:a8:14:1a:c1:3e:c1:f6:29:c4:88:96:b3:65:55:b3:44
Signer

Actual PE Digest

28:4e:ca:37:80:45:ca:49:80:3c:35:e1:e9:d1:9b:0b:a8:14:1a:c1:3e:c1:f6:29:c4:88:96:b3:65:55:b3:44

Digest Algorithm

sha256

PE Digest Matches

true

d3:c1:74:ad:d6:34:31:cc:b2:94:12:3d:3f:8c:19:92:d5:eb:9d:bd
Signer

Actual PE Digest

d3:c1:74:ad:d6:34:31:cc:b2:94:12:3d:3f:8c:19:92:d5:eb:9d:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IofCompleteRequest
KeTickCount
IoDeleteDevice
RtlInitUnicodeString
IoCreateDevice
MmMapLockedPagesSpecifyCache
IoDeleteSymbolicLink

hal

WRITE_PORT_UCHAR
READ_PORT_UCHAR
READ_PORT_ULONG

Sections

.text
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 446B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 128B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf0820e6583a1b085646c650db8667e5

Code Sign

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

08:90:e0:ba:ad:a0:7c:44:61:1f:f7:ab:81:21:0b:17Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

04:f9:b0:fe:f4:fa:7d:6f:19:e6:a1:e4:ed:7a:c3:0eCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

28:4e:ca:37:80:45:ca:49:80:3c:35:e1:e9:d1:9b:0b:a8:14:1a:c1:3e:c1:f6:29:c4:88:96:b3:65:55:b3:44Signer

d3:c1:74:ad:d6:34:31:cc:b2:94:12:3d:3f:8c:19:92:d5:eb:9d:bdSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 512B - Virtual size: 464B

.rdata Size: 256B - Virtual size: 198B

.data Size: 128B - Virtual size: 8B

INIT Size: 512B - Virtual size: 446B

.reloc Size: 128B - Virtual size: 78B

61:1c:b2:8a:00:00:00:00:00:26
Certificate

08:90:e0:ba:ad:a0:7c:44:61:1f:f7:ab:81:21:0b:17
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

04:f9:b0:fe:f4:fa:7d:6f:19:e6:a1:e4:ed:7a:c3:0e
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

28:4e:ca:37:80:45:ca:49:80:3c:35:e1:e9:d1:9b:0b:a8:14:1a:c1:3e:c1:f6:29:c4:88:96:b3:65:55:b3:44
Signer

d3:c1:74:ad:d6:34:31:cc:b2:94:12:3d:3f:8c:19:92:d5:eb:9d:bd
Signer

.text
Size: 512B - Virtual size: 464B

.rdata
Size: 256B - Virtual size: 198B

.data
Size: 128B - Virtual size: 8B

INIT
Size: 512B - Virtual size: 446B

.reloc
Size: 128B - Virtual size: 78B