1deff48ed8616bf8f7fc3e4c39902f87

Sharing

Copy URL Twitter E-mail

General

Target

1deff48ed8616bf8f7fc3e4c39902f87
Size

48KB
MD5

1deff48ed8616bf8f7fc3e4c39902f87
SHA1

b2fd2d376c407b5a343d9a8fb63ab7092891d104
SHA256

11bfbfa938e36e32738357dedd1c562a50d1882fbbc4249a437ecb8d4521f13f
SHA512

5b5f4550a55c9b38c833abbdc3942fc9aea10df27e6c15981aaf1e330e719bb41a30bee6ce3ce925f7e84d029ba8d63dd517521506d5b7b983570798f7131481
SSDEEP

768:lw7G2EjsnyXeOUEGG0LA8tWl5zrY70h6aqxcCTbkHgRwlZDHyrriSHr+:KFID6EGnLA8AlOT4Hgm7yrriIr+

Score

1^/10

Malware Config

Signatures

Files

1deff48ed8616bf8f7fc3e4c39902f87
.sys windows:6 windows x64 arch:x64

d924cf3cd6cb16a79106a721adc63bad

Code Sign

cb:b1:71:9f:79:78:9d:8d:14:f5:f9:57:a5:7a:86:21
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/03/2015, 00:00

Not After

15/03/2016, 23:59

Subject

CN=Spotflux,O=Spotflux,POSTALCODE=11249,STREET=Suite 3+STREET=110 Kent Ave,L=Brooklyn,ST=NY,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d7:79:2c:a0:73:50:40:c2:dd:f2:a1:51:a5:78:b0:e5:8a:42:b6:06
Signer

Actual PE Digest

d7:79:2c:a0:73:50:40:c2:dd:f2:a1:51:a5:78:b0:e5:8a:42:b6:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeBugCheckEx
ZwOpenKey
ZwClose
RtlInitUnicodeString
ExUuidCreate
IoAllocateMdl
IoReleaseCancelSpinLock
IoCreateDevice
MmFreePagesFromMdl
PsGetCurrentProcessId
IoCreateSymbolicLink
IofCompleteRequest
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
MmAllocatePagesForMdl
KeInitializeDpc
RtlAppendUnicodeToString
IoDeleteDevice
KeRemoveQueueDpc
IoDeleteSymbolicLink
MmUnmapLockedPages
KeAcquireSpinLockRaiseToDpc
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPopEntrySList
KeReleaseSpinLock
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExFreePoolWithTag
ExAllocatePoolWithTag
__C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpmSubLayerAdd0
FwpsQueryPacketInjectionState0
FwpmSubLayerEnum0
FwpmTransactionCommit0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmProviderContextDeleteByKey0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmEngineOpen0
FwpsAcquireClassifyHandle0
FwpmFilterAdd0
FwpsPendClassify0
FwpsCalloutRegister1
FwpmTransactionBegin0
FwpmEngineClose0
FwpmFreeMemory0
FwpsAcquireWritableLayerDataPointer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsDiscardClonedStreamData0
FwpsReleaseClassifyHandle0
FwpsStreamInjectAsync0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsFlowRemoveContext0
FwpsFreeCloneNetBufferList0
FwpsApplyModifiedLayerData0
FwpsInjectTransportSendAsync0
FwpsCopyStreamDataToBuffer0
FwpsInjectTransportReceiveAsync0
FwpsInjectionHandleCreate0
FwpsAllocateNetBufferAndNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0

ndis.sys

NdisAllocateGenericObject
NdisGetDataBuffer
NdisWaitEvent
NdisAllocateNetBufferListPool
NdisInitializeEvent
NdisRetreatNetBufferDataStart
NdisFreeGenericObject
NdisAdvanceNetBufferDataStart
NdisFreeNetBufferListPool

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d924cf3cd6cb16a79106a721adc63bad

Code Sign

cb:b1:71:9f:79:78:9d:8d:14:f5:f9:57:a5:7a:86:21Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

d7:79:2c:a0:73:50:40:c2:dd:f2:a1:51:a5:78:b0:e5:8a:42:b6:06Signer

Headers

File Characteristics

Imports

ntoskrnl.exe

fwpkclnt.sys

ndis.sys

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 984B

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 992B

cb:b1:71:9f:79:78:9d:8d:14:f5:f9:57:a5:7a:86:21
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

d7:79:2c:a0:73:50:40:c2:dd:f2:a1:51:a5:78:b0:e5:8a:42:b6:06
Signer

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 984B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 992B