89d1e5f0bc215c98d34d12336e84d78402749905342e1282934c8da646a0bff0

Sharing

Copy URL

Twitter E-mail

General

Target

89d1e5f0bc215c98d34d12336e84d78402749905342e1282934c8da646a0bff0
Size

15.7MB
MD5

a33e9a4eea1618e4c6f0d82086ef2b43
SHA1

54866240970abf77cb5cef11dffc731878594675
SHA256

89d1e5f0bc215c98d34d12336e84d78402749905342e1282934c8da646a0bff0
SHA512

5830ef69b047258859bf5303921e336fbba7dc038e85876a9e3aecbf01ce645828744d2b80a79c3d49932c0c398e6df5d6ce0a9faee453f63564e9da8d496d0a
SSDEEP

393216:ASzyqROgRxWrE+4uh4aocZMDX6B46nzpU0fzm:AS22OgRxcXp8DqBTzW0Lm

Score

1^/10

Malware Config

Signatures

Files

89d1e5f0bc215c98d34d12336e84d78402749905342e1282934c8da646a0bff0
.sys windows:10 windows x64

09f1fb05a2809196e7a2cb594bcf776c

Code Sign

11:ea:9b:47:ed:c5:35:77:34:0f:a1:4e:14:7e:91:32
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22/02/2010, 00:00

Not After

22/02/2012, 23:59

Subject

CN=Xtreaming Technology Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Xtreaming Technology Inc.,L=Taichung,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

29:6f:4f:f0:ea:8d:03:63:e4:56:ad:9e:cf:ee:51:c1:c9:35:1b:c3
Signer

Actual PE Digest

29:6f:4f:f0:ea:8d:03:63:e4:56:ad:9e:cf:ee:51:c1:c9:35:1b:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI

ntoskrnl.exe

RtlAnsiStringToUnicodeString
NtQuerySystemInformation
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

HalReturnToFirmware
KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tvm0
Size: - Virtual size: 14.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tvm1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tvm2
Size: 15.7MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09f1fb05a2809196e7a2cb594bcf776c

Code Sign

11:ea:9b:47:ed:c5:35:77:34:0f:a1:4e:14:7e:91:32Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

29:6f:4f:f0:ea:8d:03:63:e4:56:ad:9e:cf:ee:51:c1:c9:35:1b:c3Signer

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 143KB

.rdata Size: - Virtual size: 5KB

.data Size: - Virtual size: 1.6MB

.pdata Size: - Virtual size: 1KB

INIT Size: - Virtual size: 4KB

.tvm0 Size: - Virtual size: 14.3MB

.tvm1 Size: 2KB - Virtual size: 1KB

.tvm2 Size: 15.7MB - Virtual size: 15.7MB

.reloc Size: 512B - Virtual size: 72B

11:ea:9b:47:ed:c5:35:77:34:0f:a1:4e:14:7e:91:32
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

29:6f:4f:f0:ea:8d:03:63:e4:56:ad:9e:cf:ee:51:c1:c9:35:1b:c3
Signer

.text
Size: - Virtual size: 143KB

.rdata
Size: - Virtual size: 5KB

.data
Size: - Virtual size: 1.6MB

.pdata
Size: - Virtual size: 1KB

INIT
Size: - Virtual size: 4KB

.tvm0
Size: - Virtual size: 14.3MB

.tvm1
Size: 2KB - Virtual size: 1KB

.tvm2
Size: 15.7MB - Virtual size: 15.7MB

.reloc
Size: 512B - Virtual size: 72B