f19cf724fdba354066ef247c4b67e98a548bcc1970fdef0c82c6b7f6f9f0da70

Sharing

Copy URL

Twitter E-mail

General

Target

f19cf724fdba354066ef247c4b67e98a548bcc1970fdef0c82c6b7f6f9f0da70
Size

5.2MB
MD5

9666f0fa71a215cb75fe25436221f793
SHA1

9ac10827d81532c77964739e9f1b981e3364c1a3
SHA256

f19cf724fdba354066ef247c4b67e98a548bcc1970fdef0c82c6b7f6f9f0da70
SHA512

f49a676de568390d88be1df9d3d82ecfb28d97295d4e4a7798a9cde37ed16e1b58b254dc26e835c28f5c6c6d20bdf6ba3b29b3af42ad1edf47e657da587da79a
SSDEEP

98304:DBBuGJh0tqB7pD6J6LMECHdZ4c6aYZ/I7Fw:DBBPj0YMSME4d6n/I7Fw

Score

1^/10

Malware Config

Signatures

Files

f19cf724fdba354066ef247c4b67e98a548bcc1970fdef0c82c6b7f6f9f0da70
.sys windows:10 windows x64 arch:x64

91190aa88d9c7fe625aed3b7f920ae18

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20-05-2013 00:00

Not After

20-05-2014 23:59

Subject

CN=Shenzhen yundian Technology Co.\, Ltd,O=Shenzhen yundian Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:31

Not After

22-02-2021 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-11-2005 13:46

Not After

01-11-2025 13:54

Subject

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

f4:ac:3c:00:0a:ad:64:11:f7:35:ba:7d:c2:a8:6e:48:62:27:56:2d
Signer

Actual PE Digest

f4:ac:3c:00:0a:ad:64:11:f7:35:ba:7d:c2:a8:6e:48:62:27:56:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

cng.sys

BCryptGenRandom

ntoskrnl.exe

RtlInitUnicodeString
ZwClose
RtlInitAnsiString
RtlDeleteRegistryValue
RtlAppendUnicodeToString
DbgPrint
ExAllocatePool
ExFreePoolWithTag
MmGetSystemRoutineAddress
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
ZwOpenKey
ZwDeleteKey
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlCompareString
MmIsAddressValid
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
RtlPcToFileHeader
RtlImageNtHeader
IoFileObjectType
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
__C_specific_handler
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePoolWithTag
MmFreeContiguousMemory
RtlImageDirectoryEntryToData
RtlUnicodeToMultiByteN
KeBugCheckEx
_stricmp
NtQuerySystemInformation
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwWaitForSingleObject
ZwDeviceIoControlFile
ZwOpenFile
_wcsnicmp
ZwEnumerateKey
ZwCreateEvent
MmGetSystemRoutineAddress
ZwCreateFile
__C_specific_handler
KeSetSystemAffinityThread
KeQueryActiveProcessors
KeQueryTimeIncrement
DbgBreakPointWithStatus
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoAllocateMdl
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
ExFreePoolWithTag
ExAllocatePool
KeRevertToUserAffinityThread
DbgPrint
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Cc0
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91190aa88d9c7fe625aed3b7f920ae18

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38Certificate

Key Usages

f4:ac:3c:00:0a:ad:64:11:f7:35:ba:7d:c2:a8:6e:48:62:27:56:2dSigner

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

cng.sys

ntoskrnl.exe

hal

Sections

.text Size: 334KB - Virtual size: 334KB

.rdata Size: 214KB - Virtual size: 214KB

.data Size: 1KB - Virtual size: 15KB

.pdata Size: 13KB - Virtual size: 12KB

INIT Size: 2KB - Virtual size: 1KB

.Cc0 Size: 3.0MB - Virtual size: 3.0MB

.Cc1 Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 3KB - Virtual size: 2KB

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38
Certificate

f4:ac:3c:00:0a:ad:64:11:f7:35:ba:7d:c2:a8:6e:48:62:27:56:2d
Signer

.text
Size: 334KB - Virtual size: 334KB

.rdata
Size: 214KB - Virtual size: 214KB

.data
Size: 1KB - Virtual size: 15KB

.pdata
Size: 13KB - Virtual size: 12KB

INIT
Size: 2KB - Virtual size: 1KB

.Cc0
Size: 3.0MB - Virtual size: 3.0MB

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 3KB - Virtual size: 2KB