e1405a2b0ea1416fffaa3fe5857a98a3

Sharing

Copy URL Twitter E-mail

General

Target

e1405a2b0ea1416fffaa3fe5857a98a3
Size

1.1MB
MD5

e1405a2b0ea1416fffaa3fe5857a98a3
SHA1

6ef75388a4c107e752ca5c28a6d36fb4181c6808
SHA256

d7628eaf00ff911a1ed1e85ea9eae122b7a1f0cc23413b4700a49ad8e66d3a04
SHA512

25fb8b29b52bec26c5f86d218ce96f041d6340c874e06573d70cccf5cae9f2aedacfa3fdf091d3bdff3e25aee25cc5987cfc742acddfc7641524339f718541b0
SSDEEP

24576:N9UpJwi1tZ3sPibLpgjACkyyeiPnjeNENyiPsCCfM:TUpJ/1t1sPkNdI4nPcKkM

Score

1^/10

Malware Config

Signatures

Files

e1405a2b0ea1416fffaa3fe5857a98a3
.sys windows:10 windows x64 arch:x64

5363db073b650ed185827e6582e94cbd

Code Sign

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

17/01/2014, 00:00

Not After

17/01/2016, 23:59

Subject

CN=Binzhoushi Yongyu Feed Co.\,LTd.,O=Binzhoushi Yongyu Feed Co.\,LTd.,L=Binzhou,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:b5:71:6a:fc:2e:30:d5:e4:e4:a7:72:48:65:3a:a7:bb:cd:a5:1f
Signer

Actual PE Digest

c4:b5:71:6a:fc:2e:30:d5:e4:e4:a7:72:48:65:3a:a7:bb:cd:a5:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI
WskDeregister
WskRegister

ntoskrnl.exe

wcsstr
RtlInitUnicodeString
DbgPrint
RtlTimeToTimeFields
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
ExSystemTimeToLocalTime
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPages
IoAllocateIrp
IoAllocateMdl
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
strstr
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeIrp
IoFreeMdl
IoGetAttachedDeviceReference
IoGetDeviceObjectPointer
ObfDereferenceObject
ZwCreateFile
ZwClose
MmIsAddressValid
ZwDeviceIoControlFile
IoEnumerateDeviceObjectList
ObQueryNameString
_vsnprintf
sprintf
swprintf
ObReferenceObjectByName
ZwQuerySystemInformation
MmCopyMemory
__C_specific_handler
IoDriverObjectType
KeBugCheckEx
tolower
IoCreateSymbolicLink

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

sdgrt0
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5363db073b650ed185827e6582e94cbd

Code Sign

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

c4:b5:71:6a:fc:2e:30:d5:e4:e4:a7:72:48:65:3a:a7:bb:cd:a5:1fSigner

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 12KB

.pdata Size: 1024B - Virtual size: 792B

.gfids Size: 512B - Virtual size: 4B

INIT Size: 2KB - Virtual size: 1KB

sdgrt0 Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 512B - Virtual size: 184B

5d:11:78:4f:b8:17:65:02:3f:89:a4:f4:24:3f:e1:a9
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

c4:b5:71:6a:fc:2e:30:d5:e4:e4:a7:72:48:65:3a:a7:bb:cd:a5:1f
Signer

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 12KB

.pdata
Size: 1024B - Virtual size: 792B

.gfids
Size: 512B - Virtual size: 4B

INIT
Size: 2KB - Virtual size: 1KB

sdgrt0
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 184B