4f850919958f1996fc7a0071934404b5

Sharing

Copy URL Twitter E-mail

General

Target

4f850919958f1996fc7a0071934404b5
Size

41KB
MD5

4f850919958f1996fc7a0071934404b5
SHA1

7c7e32b99e439ea7aa9caf22d1fddb692cf94aeb
SHA256

2089c7c0e8a124e097a035f78083ef3daeed1ceb75e4a2886bf39aeaa87057db
SHA512

01860aa9d8b4f984ef909572aebf109800e6f9c9316c30dbc05848a65e36955d50781f525b4f549b9a77a22de4c9baa403dc355cde1b0f80bd54bb2c8fe9a585
SSDEEP

768:fBMTxsLrMt/GaX5wmDnh7jg1tmWk/uMpJVSviqIOSE7nmcjRX0:54iLr3ofgtmuMpJCIO3zbG

Score

1^/10

Malware Config

Signatures

Files

4f850919958f1996fc7a0071934404b5
.sys windows:6 windows x86 arch:x86

a342a1649ffced50afbf30d4558f71d1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

79:49:ff:e6:3b:16:83:dc:cb:ed:2e:59:9a:ec:df:fd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/12/2014, 00:00

Not After

26/01/2017, 23:59

Subject

CN=Corsica Technologies Ltd.,OU=R&D,O=Corsica Technologies Ltd.,L=Tel-Aviv,ST=Tel-Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:59:1d:bb:ac:b4:ba:91:27:92:21:f4:db:4c:a6:f2:de:6a:3d:64
Signer

Actual PE Digest

77:59:1d:bb:ac:b4:ba:91:27:92:21:f4:db:4c:a6:f2:de:6a:3d:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwOpenFile
ZwCreateFile
KeDelayExecutionThread
DbgPrint
RtlCopyUnicodeString
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
KeBugCheckEx
ExFreePoolWithTag
ExAllocatePoolWithTag
memset
memcpy
KeTickCount

ndis.sys

NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject

fwpkclnt.sys

FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmProviderDeleteByKey0
FwpmProviderAdd0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowRemoveContext0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpsCalloutRegister0
FwpmTransactionAbort0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpsCalloutUnregisterById0

hal

KfReleaseSpinLock
KfAcquireSpinLock

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a342a1649ffced50afbf30d4558f71d1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

79:49:ff:e6:3b:16:83:dc:cb:ed:2e:59:9a:ec:df:fdCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

77:59:1d:bb:ac:b4:ba:91:27:92:21:f4:db:4c:a6:f2:de:6a:3d:64Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

ndis.sys

fwpkclnt.sys

hal

wdfldr.sys

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 130KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 2KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

79:49:ff:e6:3b:16:83:dc:cb:ed:2e:59:9a:ec:df:fd
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

77:59:1d:bb:ac:b4:ba:91:27:92:21:f4:db:4c:a6:f2:de:6a:3d:64
Signer

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 130KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 2KB - Virtual size: 1KB