e71ec004e8436851a31b4394c5fab72d

Sharing

Copy URL Twitter E-mail

General

Target

e71ec004e8436851a31b4394c5fab72d
Size

3.8MB
MD5

e71ec004e8436851a31b4394c5fab72d
SHA1

35524ddbddd1ba7a83523a0cdaa55b7b7c788fef
SHA256

f3ad44c391a0b59443a4bbc3400413e518ca053ed8cf9473dac46b086a46706b
SHA512

800f624fcb0c2dd1e0eb3c96a268fc552f64422ccb84bafb1e6d744c38e6e15b6726780732c234d0818abd4935ecf907281c2126380f7c07659595be37dd667e
SSDEEP

49152:VhtZIUGLA4js7j5D0saee2WxKMt2wKuIlF9Zjk+uNgoMJZD8Sn:VfZIUGLbQZD0ysvKu6Zjk+uGoUZx

Score

1^/10

Malware Config

Signatures

Files

e71ec004e8436851a31b4394c5fab72d
.sys windows:6 windows x86 arch:x86

95e2d776aa8506c9ad0b2e21547ce939

Code Sign

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5d:f7:63:98:4c:a8:2d:ac:9a:14:f9:3a:ed:c4:bb:23:55:26:a1:d7
Signer

Actual PE Digest

5d:f7:63:98:4c:a8:2d:ac:9a:14:f9:3a:ed:c4:bb:23:55:26:a1:d7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

pshed

PshedEnableErrorSource
PshedSetErrorSourceInfo
PshedDisableErrorSource
PshedGetInjectionCapabilities
PshedInjectError
PshedFinalizeErrorRecord
PshedBugCheckSystem
PshedAttemptErrorRecovery
PshedWriteErrorRecord
PshedFreeMemory
PshedClearErrorRecord
PshedIsSystemWheaEnabled
PshedInitialize
PshedReadErrorRecord
PshedAllocateMemory
PshedGetBootErrorPacket
PshedGetAllErrorSources

hal

READ_PORT_ULONG
WRITE_PORT_UCHAR
WRITE_PORT_USHORT
WRITE_PORT_ULONG
HalInitializeProcessor
HalSetRealTimeClock
HalCalibratePerformanceCounter
KeRaiseIrqlToSynchLevel
HalStartNextProcessor
HalQueryMaximumProcessorCount
HalRegisterDynamicProcessor
HalStartDynamicProcessor
KeStallExecutionProcessor
HalRequestClockInterrupt
HalHandleNMI
HalBeginSystemInterrupt
HalEndSystemInterrupt
HalEnableInterrupt
READ_PORT_USHORT
HalSetProfileInterval
HalStartProfileInterrupt
HalStopProfileInterrupt
HalClearSoftwareInterrupt
HalRequestIpi
HalDisableInterrupt
HalSystemVectorDispatchEntry
KeTryToAcquireQueuedSpinLock
KeFlushWriteBuffer
HalGetInterruptTargetInformation
HalInitializeOnResume
HalProcessorIdle
HalAllocateCommonBuffer
HalFreeCommonBuffer
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
HalReadDmaCounter
KeRaiseIrql
KeLowerIrql
KeAcquireSpinLock
KeReleaseSpinLock
KeAcquireInStackQueuedSpinLockRaiseToSynch
KeAcquireQueuedSpinLockRaiseToSynch
KeTryToAcquireQueuedSpinLockRaiseToSynch
HalGetAdapter
HalAllocateCrashDumpRegisters
HalSetTimeIncrement
HalGetEnvironmentVariable
HalSetEnvironmentVariable
HalGetEnvironmentVariableEx
HalSetEnvironmentVariableEx
HalEnumerateEnvironmentVariablesEx
HalQueryEnvironmentVariableInfoEx
READ_PORT_UCHAR
HalSetBusDataByOffset
HalGetBusDataByOffset
HalReturnToFirmware
HalGetProcessorIdByNtNumber
HalTranslateBusAddress
HalGetMessageRoutingInfo
HalGetVectorInput
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
HalAllocateAdapterChannel
HalGetInterruptVector
HalRegisterErrataCallbacks
KeQueryPerformanceCounter
KfLowerIrql
KfRaiseIrql
KeReleaseQueuedSpinLock
KeAcquireQueuedSpinLock
KeGetCurrentIrql
HalAllProcessorsStarted
HalInitSystem
HalQueryRealTimeClock
HalInitializeBios
KeRaiseIrqlToDpcLevel
HalReportResourceUsage
KfReleaseSpinLock
KfAcquireSpinLock
HalRequestSoftwareInterrupt

bootvid

VidBitBlt
VidSolidColorFill
VidScreenToBufferBlt
VidCleanUp
VidDisplayString
VidSetScrollRegion
VidResetDisplay
VidBufferToScreenBlt
VidSetTextColor
VidInitialize

kdcom

KdD3Transition
KdD0Transition
KdReceivePacket
KdSendPacket
KdRestore
KdSave
KdDebuggerInitialize0
KdDebuggerInitialize1

clfs.sys

ClfsCreateMarshallingArea
ClfsLsnLess
ClfsLsnContainer
ClfsFlushToLsn
ClfsLsnInvalid
ClfsGetLogFileInformation
ClfsMgmtDeregisterManagedClient
ClfsCloseLogFileObject
ClfsMgmtInstallPolicy
ClfsAddLogContainer
ClfsCreateLogFile
CLFS_LSN_INVALID
ClfsLsnEqual
ClfsReadLogRecord
ClfsReadNextLogRecord
ClfsTerminateReadLog
ClfsWriteRestartArea
ClfsDeleteLogByPointer
ClfsDeleteMarshallingArea
CLFS_LSN_NULL
ClfsReserveAndAppendLog
ClfsLsnDifference
ClfsMgmtSetLogFileSize
ClfsReserveAndAppendLogAligned
ClfsLsnGreater
ClfsMgmtHandleLogFileFull
ClfsPrivGetBaseLogFileFromFileObjectPointer
ClfsMgmtTailAdvanceFailure
ClfsAdvanceLogBase
ClfsMgmtRegisterManagedClient
ClfsReadRestartArea

ci

CiInitialize

Exports

Exports

AlpcGetHeaderSize
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
CcCanIWrite
CcCoherencyFlushAndPurgeCache
CcCopyRead
CcCopyWrite
CcCopyWriteWontFlush
CcDeferWrite
CcFastCopyRead
CcFastCopyWrite
CcFastMdlReadWait
CcFlushCache
CcGetDirtyPages
CcGetFileObjectFromBcb
CcGetFileObjectFromSectionPtrs
CcGetFileObjectFromSectionPtrsRef
CcGetFlushedValidData
CcGetLsnForFileObject
CcInitializeCacheMap
CcIsThereDirtyData
CcIsThereDirtyDataEx
CcMapData
CcMdlRead
CcMdlReadComplete
CcMdlWriteAbort
CcMdlWriteComplete
CcPinMappedData
CcPinRead
CcPrepareMdlWrite
CcPreparePinWrite
CcPurgeCacheSection
CcRemapBcb
CcRepinBcb
CcScheduleReadAhead
CcSetAdditionalCacheAttributes
CcSetBcbOwnerPointer
CcSetDirtyPageThreshold
CcSetDirtyPinnedData
CcSetFileSizes
CcSetFileSizesEx
CcSetLogHandleForFile
CcSetParallelFlushFile
CcSetReadAheadGranularity
CcTestControl
CcUninitializeCacheMap
CcUnpinData
CcUnpinDataForThread
CcUnpinRepinnedBcb
CcWaitForCurrentLazyWriterActivity
CcZeroData
CmCallbackGetKeyObjectID
CmGetBoundTransaction
CmGetCallbackVersion
CmKeyObjectType
CmRegisterCallback
CmRegisterCallbackEx
CmSetCallbackObjectContext
CmUnRegisterCallback
DbgBreakPoint
DbgBreakPointWithStatus
DbgCommandString
DbgLoadImageSymbols
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt
DbgQueryDebugFilterState
DbgSetDebugFilterState
DbgSetDebugPrintCallback
DbgkLkmdRegisterCallback
DbgkLkmdUnregisterCallback
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmClientRuleRegisterNotification
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegister
EmProviderRegisterEntry
EmpProviderRegister
EtwActivityIdControl
EtwEnableTrace
EtwEventEnabled
EtwProviderEnabled
EtwRegister
EtwRegisterClassicProvider
EtwSendTraceBuffer
EtwUnregister
EtwWrite
EtwWriteEndScenario
EtwWriteEx
EtwWriteStartScenario
EtwWriteString
EtwWriteTransfer
ExAcquireCacheAwarePushLockExclusive
ExAcquireFastMutexUnsafe
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAcquireRundownProtection
ExAcquireRundownProtectionCacheAware
ExAcquireRundownProtectionCacheAwareEx
ExAcquireRundownProtectionEx
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExAcquireSpinLockExclusive
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockShared
ExAcquireSpinLockSharedAtDpcLevel
ExAllocateCacheAwarePushLock
ExAllocateCacheAwareRundownProtection
ExAllocateFromPagedLookasideList
ExAllocatePool
ExAllocatePoolWithQuota
ExAllocatePoolWithQuotaTag
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExConvertExclusiveToSharedLite
ExCreateCallback
ExDeleteLookasideListEx
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
ExDesktopObjectType
ExDisableResourceBoostLite
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
ExEnterCriticalRegionAndAcquireResourceExclusive
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
ExEnterPriorityRegionAndAcquireResourceExclusive
ExEnterPriorityRegionAndAcquireResourceShared
ExEnumHandleTable
ExEventObjectType
ExExtendZone
ExFetchLicenseData
ExFlushLookasideListEx
ExFreeCacheAwarePushLock
ExFreeCacheAwareRundownProtection
ExFreePool
ExFreePoolWithTag
ExFreeToPagedLookasideList
ExGetCurrentProcessorCounts
ExGetCurrentProcessorCpuUsage
ExGetExclusiveWaiterCount
ExGetLicenseTamperState
ExGetPreviousMode
ExGetSharedWaiterCount
ExInitializeLookasideListEx
ExInitializeNPagedLookasideList
ExInitializePagedLookasideList
ExInitializePushLock
ExInitializeResourceLite
ExInitializeRundownProtection
ExInitializeRundownProtectionCacheAware
ExInitializeZone
ExInterlockedAddLargeInteger
ExInterlockedAddLargeStatistic
ExInterlockedAddUlong
ExInterlockedCompareExchange64
ExInterlockedDecrementLong
ExInterlockedExchangeUlong
ExInterlockedExtendZone
ExInterlockedFlushSList
ExInterlockedIncrementLong
ExInterlockedInsertHeadList
ExInterlockedInsertTailList
ExInterlockedPopEntryList
ExInterlockedPopEntrySList
ExInterlockedPushEntryList
ExInterlockedPushEntrySList
ExInterlockedRemoveHeadList
ExIsProcessorFeaturePresent
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExLocalTimeToSystemTime
ExNotifyCallback
ExQueryAttributeInformation
ExQueryPoolBlockSize
ExQueueWorkItem
ExRaiseAccessViolation
ExRaiseDatatypeMisalignment
ExRaiseException
ExRaiseHardError
ExRaiseStatus
ExReInitializeRundownProtection
ExReInitializeRundownProtectionCacheAware
ExRegisterAttributeInformationCallback
ExRegisterCallback
ExRegisterExtension
ExReinitializeResourceLite
ExReleaseCacheAwarePushLockExclusive
ExReleaseFastMutexUnsafe
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExReleaseResourceAndLeaveCriticalRegion
ExReleaseResourceAndLeavePriorityRegion
ExReleaseResourceForThreadLite
ExReleaseResourceLite
ExReleaseRundownProtection
ExReleaseRundownProtectionCacheAware
ExReleaseRundownProtectionCacheAwareEx
ExReleaseRundownProtectionEx
ExReleaseSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockShared
ExReleaseSpinLockSharedFromDpcLevel
ExRundownCompleted
ExRundownCompletedCacheAware
ExSemaphoreObjectType
ExSetLicenseTamperState
ExSetResourceOwnerPointer
ExSetResourceOwnerPointerEx
ExSetTimerResolution
ExSizeOfRundownProtectionCacheAware
ExSystemExceptionFilter
ExSystemTimeToLocalTime
ExTryConvertSharedSpinLockExclusive
ExUnregisterAttributeInformationCallback
ExUnregisterCallback
ExUnregisterExtension
ExUpdateLicenseData
ExUuidCreate
ExVerifySuite
ExWaitForRundownProtectionRelease
ExWaitForRundownProtectionReleaseCacheAware
ExWindowStationObjectType
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfInterlockedAddUlong
ExfInterlockedCompareExchange64
ExfInterlockedInsertHeadList
ExfInterlockedInsertTailList
ExfInterlockedPopEntryList
ExfInterlockedPushEntryList
ExfInterlockedRemoveHeadList
ExfReleasePushLock
ExfReleasePushLockExclusive
ExfReleasePushLockShared
ExfTryAcquirePushLockShared
ExfTryToWakePushLock
ExfUnblockPushLock
Exfi386InterlockedDecrementLong
Exfi386InterlockedExchangeUlong
Exfi386InterlockedIncrementLong
Exi386InterlockedDecrementLong
Exi386InterlockedExchangeUlong
Exi386InterlockedIncrementLong
ExiAcquireFastMutex
ExiReleaseFastMutex
ExiTryToAcquireFastMutex
FirstEntrySList
FsRtlAcknowledgeEcp
FsRtlAcquireFileExclusive
FsRtlAddBaseMcbEntry
FsRtlAddBaseMcbEntryEx
FsRtlAddLargeMcbEntry
FsRtlAddMcbEntry
FsRtlAddToTunnelCache
FsRtlAllocateExtraCreateParameter
FsRtlAllocateExtraCreateParameterFromLookasideList
FsRtlAllocateExtraCreateParameterList
FsRtlAllocateFileLock
FsRtlAllocatePool
FsRtlAllocatePoolWithQuota
FsRtlAllocatePoolWithQuotaTag
FsRtlAllocatePoolWithTag
FsRtlAllocateResource
FsRtlAreNamesEqual
FsRtlAreThereCurrentOrInProgressFileLocks
FsRtlAreVolumeStartupApplicationsComplete
FsRtlBalanceReads
FsRtlCancellableWaitForMultipleObjects
FsRtlCancellableWaitForSingleObject
FsRtlChangeBackingFileObject
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlCheckOplock
FsRtlCheckOplockEx
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCreateSectionForDataScan
FsRtlCurrentBatchOplock
FsRtlCurrentOplock
FsRtlCurrentOplockH
FsRtlDeleteExtraCreateParameterLookasideList
FsRtlDeleteKeyFromTunnelCache
FsRtlDeleteTunnelCache
FsRtlDeregisterUncProvider
FsRtlDissectDbcs
FsRtlDissectName
FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlFindExtraCreateParameter
FsRtlFindInTunnelCache
FsRtlFreeExtraCreateParameter
FsRtlFreeExtraCreateParameterList
FsRtlFreeFileLock
FsRtlGetEcpListFromIrp
FsRtlGetFileSize
FsRtlGetNextBaseMcbEntry
FsRtlGetNextExtraCreateParameter
FsRtlGetNextFileLock
FsRtlGetNextLargeMcbEntry
FsRtlGetNextMcbEntry
FsRtlGetVirtualDiskNestingLevel
FsRtlIncrementCcFastMdlReadWait
FsRtlIncrementCcFastReadNoWait
FsRtlIncrementCcFastReadNotPossible
FsRtlIncrementCcFastReadResourceMiss
FsRtlIncrementCcFastReadWait
FsRtlInitExtraCreateParameterLookasideList
FsRtlInitializeBaseMcb
FsRtlInitializeBaseMcbEx
FsRtlInitializeExtraCreateParameter
FsRtlInitializeExtraCreateParameterList
FsRtlInitializeFileLock
FsRtlInitializeLargeMcb
FsRtlInitializeMcb
FsRtlInitializeOplock
FsRtlInitializeTunnelCache
FsRtlInsertExtraCreateParameter
FsRtlInsertPerFileContext
FsRtlInsertPerFileObjectContext
FsRtlInsertPerStreamContext
FsRtlIsDbcsInExpression
FsRtlIsEcpAcknowledged
FsRtlIsEcpFromUserMode
FsRtlIsFatDbcsLegal
FsRtlIsHpfsDbcsLegal
FsRtlIsNameInExpression
FsRtlIsNtstatusExpected
FsRtlIsPagingFile
FsRtlIsTotalDeviceFailure
FsRtlLegalAnsiCharacterArray
FsRtlLogCcFlushError
FsRtlLookupBaseMcbEntry
FsRtlLookupLargeMcbEntry
FsRtlLookupLastBaseMcbEntry
FsRtlLookupLastBaseMcbEntryAndIndex
FsRtlLookupLastLargeMcbEntry
FsRtlLookupLastLargeMcbEntryAndIndex
FsRtlLookupLastMcbEntry
FsRtlLookupMcbEntry
FsRtlLookupPerFileContext
FsRtlLookupPerFileObjectContext
FsRtlLookupPerStreamContextInternal
FsRtlMdlRead
FsRtlMdlReadComplete
FsRtlMdlReadCompleteDev
FsRtlMdlReadDev
FsRtlMdlWriteComplete
FsRtlMdlWriteCompleteDev
FsRtlMupGetProviderIdFromName
FsRtlMupGetProviderInfoFromFileObject
FsRtlNormalizeNtstatus
FsRtlNotifyChangeDirectory
FsRtlNotifyCleanup
FsRtlNotifyCleanupAll
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterReportChange
FsRtlNotifyFullChangeDirectory
FsRtlNotifyFullReportChange
FsRtlNotifyInitializeSync
FsRtlNotifyReportChange
FsRtlNotifyUninitializeSync
FsRtlNotifyVolumeEvent
FsRtlNotifyVolumeEventEx
FsRtlNumberOfRunsInBaseMcb
FsRtlNumberOfRunsInLargeMcb
FsRtlNumberOfRunsInMcb
FsRtlOplockBreakH
FsRtlOplockBreakToNone
FsRtlOplockBreakToNoneEx
FsRtlOplockFsctrl
FsRtlOplockFsctrlEx
FsRtlOplockIsFastIoPossible
FsRtlOplockIsSharedRequest
FsRtlOplockKeysEqual
FsRtlPostPagingFileStackOverflow
FsRtlPostStackOverflow
FsRtlPrepareMdlWrite
FsRtlPrepareMdlWriteDev
FsRtlPrivateLock
FsRtlProcessFileLock
FsRtlQueryMaximumVirtualDiskNestingLevel
FsRtlRegisterFileSystemFilterCallbacks
FsRtlRegisterFltMgrCalls
FsRtlRegisterMupCalls
FsRtlRegisterUncProvider
FsRtlRegisterUncProviderEx
FsRtlReleaseFile
FsRtlRemoveBaseMcbEntry
FsRtlRemoveDotsFromPath
FsRtlRemoveExtraCreateParameter
FsRtlRemoveLargeMcbEntry
FsRtlRemoveMcbEntry
FsRtlRemovePerFileContext
FsRtlRemovePerFileObjectContext
FsRtlRemovePerStreamContext
FsRtlResetBaseMcb
FsRtlResetLargeMcb
FsRtlSetEcpListIntoIrp
FsRtlSplitBaseMcb
FsRtlSplitLargeMcb
FsRtlSyncVolumes
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlTruncateBaseMcb
FsRtlTruncateLargeMcb
FsRtlTruncateMcb
FsRtlUninitializeBaseMcb
FsRtlUninitializeFileLock
FsRtlUninitializeLargeMcb
FsRtlUninitializeMcb
FsRtlUninitializeOplock
FsRtlValidateReparsePointBuffer
HalDispatchTable
HalExamineMBR
HalPrivateDispatchTable
HeadlessDispatch
HvlQueryConnection
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
InbvDisplayString
InbvEnableBootDriver
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvIsBootDriverInstalled
InbvNotifyDisplayOwnershipLost
InbvResetDisplay
InbvSetScrollRegion
InbvSetTextColor
InbvSolidColorFill
InitSafeBootMode
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
InterlockedPopEntrySList
InterlockedPushEntrySList
IoAcquireCancelSpinLock
IoAcquireRemoveLockEx
IoAcquireVpbSpinLock
IoAdapterObjectType
IoAdjustStackSizeForRedirection
IoAllocateAdapterChannel
IoAllocateController
IoAllocateDriverObjectExtension
IoAllocateErrorLogEntry
IoAllocateIrp
IoAllocateMdl
IoAllocateMiniCompletionPacket
IoAllocateSfioStreamIdentifier
IoAllocateWorkItem
IoApplyPriorityInfoThread
IoAssignResources
IoAttachDevice
IoAttachDeviceByPointer
IoAttachDeviceToDeviceStack
IoAttachDeviceToDeviceStackSafe
IoBuildAsynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoBuildPartialMdl
IoBuildSynchronousFsdRequest
IoCallDriver
IoCancelFileOpen
IoCancelIrp
IoCheckDesiredAccess
IoCheckEaBufferValidity
IoCheckFunctionAccess
IoCheckQuerySetFileInformation
IoCheckQuerySetVolumeInformation
IoCheckQuotaBufferValidity
IoCheckShareAccess
IoCheckShareAccessEx
IoClearDependency
IoClearIrpExtraCreateParameter
IoCompleteRequest
IoConnectInterrupt
IoConnectInterruptEx
IoCreateArcName
IoCreateController
IoCreateDevice
IoCreateDisk
IoCreateDriver
IoCreateFile
IoCreateFileEx
IoCreateFileSpecifyDeviceObjectHint
IoCreateNotificationEvent
IoCreateStreamFileObject
IoCreateStreamFileObjectEx
IoCreateStreamFileObjectLite
IoCreateSymbolicLink
IoCreateSynchronizationEvent
IoCreateUnprotectedSymbolicLink

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_PAGELK
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

POOLMI
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

POOLCODE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALMOSTRO
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SPINLOCK
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFY
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEHDLS
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEBGFX
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFB
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEKDD
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEVRFC
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEVRFD
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95e2d776aa8506c9ad0b2e21547ce939

Code Sign

61:02:8e:42:00:00:00:00:00:1fCertificate

Extended Key Usages

61:05:dd:42:00:00:00:00:00:14Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

5d:f7:63:98:4c:a8:2d:ac:9a:14:f9:3a:ed:c4:bb:23:55:26:a1:d7Signer

Headers

File Characteristics

Imports

pshed

hal

bootvid

kdcom

clfs.sys

ci

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

_PAGELK Size: 2KB - Virtual size: 2KB

POOLMI Size: 3KB - Virtual size: 2KB

POOLCODE Size: 7KB - Virtual size: 6KB

.data Size: 35KB - Virtual size: 282KB

ALMOSTRO Size: 3KB - Virtual size: 3KB

SPINLOCK Size: 1024B - Virtual size: 7KB

PAGE Size: 1.7MB - Virtual size: 1.7MB

PAGELK Size: 70KB - Virtual size: 70KB

PAGEKD Size: 18KB - Virtual size: 17KB

PAGEVRFY Size: 92KB - Virtual size: 91KB

PAGEHDLS Size: 7KB - Virtual size: 7KB

PAGEBGFX Size: 19KB - Virtual size: 19KB

PAGEVRFB Size: - Virtual size: 9KB

.edata Size: 69KB - Virtual size: 68KB

PAGEDATA Size: 33KB - Virtual size: 33KB

PAGEKDD Size: 48KB - Virtual size: 48KB

PAGEVRFC Size: 9KB - Virtual size: 9KB

PAGEVRFD Size: 3KB - Virtual size: 2KB

INIT Size: 275KB - Virtual size: 274KB

.rsrc Size: 209KB - Virtual size: 209KB

.reloc Size: 102KB - Virtual size: 102KB

61:02:8e:42:00:00:00:00:00:1f
Certificate

61:05:dd:42:00:00:00:00:00:14
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

5d:f7:63:98:4c:a8:2d:ac:9a:14:f9:3a:ed:c4:bb:23:55:26:a1:d7
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

_PAGELK
Size: 2KB - Virtual size: 2KB

POOLMI
Size: 3KB - Virtual size: 2KB

POOLCODE
Size: 7KB - Virtual size: 6KB

.data
Size: 35KB - Virtual size: 282KB

ALMOSTRO
Size: 3KB - Virtual size: 3KB

SPINLOCK
Size: 1024B - Virtual size: 7KB

PAGE
Size: 1.7MB - Virtual size: 1.7MB

PAGELK
Size: 70KB - Virtual size: 70KB

PAGEKD
Size: 18KB - Virtual size: 17KB

PAGEVRFY
Size: 92KB - Virtual size: 91KB

PAGEHDLS
Size: 7KB - Virtual size: 7KB

PAGEBGFX
Size: 19KB - Virtual size: 19KB

PAGEVRFB
Size: - Virtual size: 9KB

.edata
Size: 69KB - Virtual size: 68KB

PAGEDATA
Size: 33KB - Virtual size: 33KB

PAGEKDD
Size: 48KB - Virtual size: 48KB

PAGEVRFC
Size: 9KB - Virtual size: 9KB

PAGEVRFD
Size: 3KB - Virtual size: 2KB

INIT
Size: 275KB - Virtual size: 274KB

.rsrc
Size: 209KB - Virtual size: 209KB

.reloc
Size: 102KB - Virtual size: 102KB