TEYcr[.]sys | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

TEYcr.sys
Size

685KB
MD5

c980bc67d9c05620fd023535d707c101
SHA1

ad57b86d62d456e7f04bfe1f34a419795134ad8a
SHA256

3ad68c2df881ea74513b04bb6d2b731ed287e2a44ccd56882762d6a557dd4487
SHA512

da5bf9e5e5be86653bc48fc8fd7d8ef6235db14da07766a7b341ebc1bdceb5499f7c1612eb8a024199643e3b1ef551489049814e286cc4eaeecb9225755fa03a
SSDEEP

12288:KYjNGMLI7P3119UnIO0OizJLyl1kTqNTyZJgvwisBQ1Zb2nADrvp94I7fJ+8RSfl:Xyd19Uf0OiJLyjkTqNTyHgvwisBQZb2x

Score

1^/10

Malware Config

Signatures

Files

TEYcr.sys
.sys windows:10 windows x64

a567d91900d111a658b6b09600d0b060

Code Sign

38:de:06:b8:be:15:18:7f:10:7e:04:f8:b1:13:89:77
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

02-03-2018 00:00

Not After

28-11-2018 23:59

Subject

CN=Bopsoft,O=Bopsoft,L=Zaozhuang,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:31

Not After

22-02-2021 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

81:f7:79:c8:15:2e:64:d4:60:22:a3:2d:83:ca:ad:f6:3c:f5:48:03
Signer

Actual PE Digest

81:f7:79:c8:15:2e:64:d4:60:22:a3:2d:83:ca:ad:f6:3c:f5:48:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

rand

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 647KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a567d91900d111a658b6b09600d0b060

Code Sign

38:de:06:b8:be:15:18:7f:10:7e:04:f8:b1:13:89:77Certificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

81:f7:79:c8:15:2e:64:d4:60:22:a3:2d:83:ca:ad:f6:3c:f5:48:03Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.sedata Size: 647KB - Virtual size: 648KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

38:de:06:b8:be:15:18:7f:10:7e:04:f8:b1:13:89:77
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

81:f7:79:c8:15:2e:64:d4:60:22:a3:2d:83:ca:ad:f6:3c:f5:48:03
Signer

.text
Size: 28KB - Virtual size: 28KB

.sedata
Size: 647KB - Virtual size: 648KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB