8757bfc21d1189631ea050252d74ac29[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

8757bfc21d1189631ea050252d74ac29.bin
Size

65KB
MD5

fbadfa764ce2a9d1222e16abadab34c2
SHA1

9eade92cf3114f326b31eab507d9ff457b2a201d
SHA256

282d115e2d9d49a185191f28bfd977982f3f6d9a714a805d1a714b381a1fe145
SHA512

b1d71105cae84dc10ec2f88259de99b0e64e02e8b3d80d005020f0c3345d426a66eaf8101af0fcbb364f5d8132d7ab9289c5a961d65c1e5cec040e1af7f68fd4
SSDEEP

1536:TuHt0NcLkGWn5RQOk730lzfF9369JPF+wV:KvLkLn5o730lzfFNC+wV

Score

1^/10

Malware Config

Signatures

Files

8757bfc21d1189631ea050252d74ac29.bin
.zip

Password: infected
16c6a5db7819622cc568aea78a2d4e74c2465b9fc3797923d58d4c84fe35a24b.bin
.sys windows:6 windows x64 arch:x64

be0444bb7e9a09ef9e269f264c36d99a

Code Sign

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/01/2023, 19:14

Not After

15/12/2023, 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/12/2021, 14:10

Not After

10/02/2025, 13:32

Subject

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3b
Signer

Actual PE Digest

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3b

Digest Algorithm

sha256

PE Digest Matches

true

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3b
Signer

Actual PE Digest

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ZwCreateFile
ZwWriteFile
ZwClose
RtlInitAnsiString
RtlWriteRegistryValue
RtlCreateRegistryKey
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlInitUnicodeString
ZwQueryInformationFile
ZwReadFile
KeInitializeEvent
KeSetEvent
RtlCompareMemory
ExInterlockedInsertTailList
IofCompleteRequest
SeTokenType
SeCreateClientSecurity
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
RtlClearAllBits
RtlSetAllBits
RtlSetBits
RtlFindFirstRunClear
RtlAreBitsSet
RtlFindNextForwardRunClear
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExInterlockedInsertHeadList
__C_specific_handler
ExAllocatePool
_wcsicmp
_wcsnicmp
RtlQueryRegistryValues
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlxAnsiStringToUnicodeSize
DbgPrint
KeSetPriorityThread
KeWaitForMultipleObjects
KeWaitForSingleObject
ExInterlockedRemoveHeadList
ExInitializeResourceLite
ExDeleteResourceLite
MmQuerySystemSize
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
SeCaptureSubjectContext
PsCreateSystemThread
PsTerminateSystemThread
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ZwCreateDirectoryObject
ZwMakeTemporaryObject
ZwOpenKey
RtlInitializeGenericTable
ExUuidCreate
SeTokenIsAdmin
SeImpersonateClient
PsRevertToSelf
_vsnprintf
_vsnwprintf
NlsMbOemCodePageTag
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
_local_unwind
ZwQueryDirectoryFile
swprintf
ZwOpenProcessToken
ZwAdjustPrivilegesToken
RtlInitializeBitMap
PsGetVersion
ZwQueryValueKey
MmGetSystemRoutineAddress
IoCreateDevice
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
KeBugCheckEx

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

be0444bb7e9a09ef9e269f264c36d99a

Code Sign

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3bSigner

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3bSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 17KB

.pdata Size: 2KB - Virtual size: 1KB

PAGE Size: 7KB - Virtual size: 7KB

INIT Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 168B

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3b
Signer

72:18:a4:a0:93:df:4d:36:d2:30:93:43:a7:69:20:4d:d1:87:09:e6:ed:03:c8:af:44:a4:c5:20:fe:94:72:3b
Signer

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 17KB

.pdata
Size: 2KB - Virtual size: 1KB

PAGE
Size: 7KB - Virtual size: 7KB

INIT
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 168B