f9eb69dbcedcc7a88e18a0e91386b69d

Sharing

Copy URL Twitter E-mail

General

Target

f9eb69dbcedcc7a88e18a0e91386b69d
Size

354KB
MD5

f9eb69dbcedcc7a88e18a0e91386b69d
SHA1

8ff6aef2a3a967598854700aa8475aa0fb33c339
SHA256

de5713d93f23fe44937b3b824370200fc3d0b59c7ad89958d4ed7201a6571f3c
SHA512

cf9e6ce1456386654987f02a40a326c6e19b0aff302df35d237366c3ff5076cf69cb1613e8cd0a1575b8a03b9a6d7679376b5207ade781b5f22bd1d21c94ca9f
SSDEEP

6144:OEn9BgtNw8uiMcp7NikqB+S4aH7WaH7QyspbWGP+ZUgCzTHcf2iNQBpD:OrFuiMcptObtbQ/WSceiNQB9

Score

1^/10

Malware Config

Signatures

Files

f9eb69dbcedcc7a88e18a0e91386b69d
.sys windows:6 windows x64 arch:x64

73a621d3be02111b9b3ad06c495b3680

Code Sign

45:cc:25:b7:2c:a6:0c:94:f9:bc:f7:90:eb:83:f0:01
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

09/02/2015, 07:51

Not After

09/02/2016, 07:51

Subject

CN=杭州升科计算机技术有限公司,O=杭州升科计算机技术有限公司,L=杭州市,ST=浙江省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:05:86:6e:cb:0d:35:eb:1c:19:84:bc:d9:69:69:ff:74:a7:65:0a
Signer

Actual PE Digest

5f:05:86:6e:cb:0d:35:eb:1c:19:84:bc:d9:69:69:ff:74:a7:65:0a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeEvent
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
IoCancelIrp
ZwCreateFile
IofCompleteRequest
ObReferenceObjectByHandle
IoFreeIrp
MmProbeAndLockPages
IoAllocateMdl
IofCallDriver
ZwCreateKey
ExReleaseFastMutex
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
ExAcquireFastMutex
IoDeleteDevice
RtlAppendUnicodeToString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwSetValueKey
RtlFreeUnicodeString
IoGetDeviceObjectPointer
ExSystemTimeToLocalTime
ZwQueryValueKey
rand
KeQueryTimeIncrement
srand
RtlAppendUnicodeStringToString
ZwFlushKey
IoCreateDevice
ZwDeleteKey
ZwOpenKey
ExFreePoolWithTag
KeSetEvent
ExAllocatePool
KeAcquireSpinLockRaiseToDpc
IoDetachDevice
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
_strnicmp
strstr
_snprintf
strncpy
PsGetCurrentThreadId
DbgPrint
ZwEnumerateKey
ExAllocatePoolWithTag
ZwFsControlFile
IoAttachDeviceToDeviceStackSafe
ZwQuerySymbolicLinkObject
ZwReadFile
swprintf
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwSetInformationFile
ObQueryNameString
ZwWaitForSingleObject
PsCreateSystemThread
IoGetDeviceAttachmentBaseRef
IoCreateFileSpecifyDeviceObjectHint
ZwFlushBuffersFile
ZwDeleteFile
RtlCompareUnicodeString
ZwDeviceIoControlFile
RtlCopyUnicodeString
ZwOpenFile
ZwQueryInformationFile
ZwWriteFile
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
KeInitializeTimerEx
KeCancelTimer
KeBugCheckEx
KeReleaseSpinLock
RtlInitUnicodeString
RtlAnsiCharToUnicodeChar
__C_specific_handler

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73a621d3be02111b9b3ad06c495b3680

Code Sign

45:cc:25:b7:2c:a6:0c:94:f9:bc:f7:90:eb:83:f0:01Certificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79Certificate

Extended Key Usages

Key Usages

5f:05:86:6e:cb:0d:35:eb:1c:19:84:bc:d9:69:69:ff:74:a7:65:0aSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 28KB

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 410B

45:cc:25:b7:2c:a6:0c:94:f9:bc:f7:90:eb:83:f0:01
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

5f:05:86:6e:cb:0d:35:eb:1c:19:84:bc:d9:69:69:ff:74:a7:65:0a
Signer

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 28KB

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 410B