f16a7ce7b9968017b82236cecc8bb63c1140d6863f79b9be2af5cb23689f149a

Sharing

Copy URL Twitter E-mail

General

Target

f16a7ce7b9968017b82236cecc8bb63c1140d6863f79b9be2af5cb23689f149a
Size

582KB
MD5

3eb76ecd52803313165a0858ecc13482
SHA1

6a672d439e72ee20858faded831515202281b75b
SHA256

f16a7ce7b9968017b82236cecc8bb63c1140d6863f79b9be2af5cb23689f149a
SHA512

041ca5ea5782137a87fdba177e7c5a44f9608428b32fcb475ef6b8b017586f8a85b51ea470f750b01acf51c67db69b32198e44082781800830d3543c9708fe40
SSDEEP

12288:CijULwx2BdK2O0c1vsNa91EH1i7es0lpTGRVuVCo3j:csG1OlYH87es0ldYVJaj

Score

1^/10

Malware Config

Signatures

Files

f16a7ce7b9968017b82236cecc8bb63c1140d6863f79b9be2af5cb23689f149a
.sys windows:6 windows x64

d85d7f96184e86247c54fe76921a7eeb

Code Sign

77:76:92:40:d8:19:a3:f2:eb:2e:7f:8b:af:fe:cd:26
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/07/2013, 00:00

Not After

18/07/2014, 23:59

Subject

CN=Huiping Zhong,OU=Individual Developer,O=No Organization Affiliation,L=Heyuan,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:12:3d:af:3b:03:84:35:1c:8e:58:b9:a5:4c:c7:4f:90:58:6e:c5:de:37:a6:d6:ce:67:5d:57:08:9d:f6:3e
Signer

Actual PE Digest

f7:12:3d:af:3b:03:84:35:1c:8e:58:b9:a5:4c:c7:4f:90:58:6e:c5:de:37:a6:d6:ce:67:5d:57:08:9d:f6:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoCreateFile
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation

hal

HalTranslateBusAddress
HalMakeBeep

Sections

.text
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INITKDBG
Size: - Virtual size: 469B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.TLS0
Size: - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.TLS1
Size: 575KB - Virtual size: 575KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d85d7f96184e86247c54fe76921a7eeb

Code Sign

77:76:92:40:d8:19:a3:f2:eb:2e:7f:8b:af:fe:cd:26Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

f7:12:3d:af:3b:03:84:35:1c:8e:58:b9:a5:4c:c7:4f:90:58:6e:c5:de:37:a6:d6:ce:67:5d:57:08:9d:f6:3eSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 60KB

INITKDBG Size: - Virtual size: 469B

.rdata Size: - Virtual size: 3KB

.data Size: - Virtual size: 8KB

.pdata Size: - Virtual size: 2KB

INIT Size: - Virtual size: 4KB

.TLS0 Size: - Virtual size: 616KB

.TLS1 Size: 575KB - Virtual size: 575KB

.reloc Size: 512B - Virtual size: 36B

.rsrc Size: 1KB - Virtual size: 1KB

77:76:92:40:d8:19:a3:f2:eb:2e:7f:8b:af:fe:cd:26
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

f7:12:3d:af:3b:03:84:35:1c:8e:58:b9:a5:4c:c7:4f:90:58:6e:c5:de:37:a6:d6:ce:67:5d:57:08:9d:f6:3e
Signer

.text
Size: - Virtual size: 60KB

INITKDBG
Size: - Virtual size: 469B

.rdata
Size: - Virtual size: 3KB

.data
Size: - Virtual size: 8KB

.pdata
Size: - Virtual size: 2KB

INIT
Size: - Virtual size: 4KB

.TLS0
Size: - Virtual size: 616KB

.TLS1
Size: 575KB - Virtual size: 575KB

.reloc
Size: 512B - Virtual size: 36B

.rsrc
Size: 1KB - Virtual size: 1KB