5d09dcaa71280ed1ce7f6d3b7141cffd

Sharing

Copy URL Twitter E-mail

General

Target

5d09dcaa71280ed1ce7f6d3b7141cffd
Size

40KB
MD5

5d09dcaa71280ed1ce7f6d3b7141cffd
SHA1

fd126cc6f66e80dda51095d9f76fd63159374ceb
SHA256

d4f34f705af2188968cf320b247e3ae25951518d2abb2a1830e4a3ed720d8cd1
SHA512

1649a5cdc2c8be697f5f5505f51b24ef14defe774dc17924c5350f9dc36316a682995f85340b42d4192237684c2ac4158d1e2ac81dbf96104f9e17096139de05
SSDEEP

768:UQIKU7I3SHD4dHy/CjQ1U3CdxEb5aNxFSCduunZy2pbCxMmAq:U9zHIfQ2IFTQy3ZCxDAq

Score

1^/10

Malware Config

Signatures

Files

5d09dcaa71280ed1ce7f6d3b7141cffd
.sys windows:6 windows x64 arch:x64

1e4beeb2996d81f978c14eb460eed11a

Code Sign

42:1c:b6:de:8a:18:ac:26:c5:2b:2d:f9:8e:52:d1:eb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

30/07/2010, 00:00

Not After

30/07/2011, 23:59

Subject

CN=HT Srl,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HT Srl,L=Milan,ST=Italy,C=IT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:ac:d2:b6:ba:d0:62:0b:7f:e0:ac:29:62:ea:88:e8:0c:c9:44:0c
Signer

Actual PE Digest

bd:ac:d2:b6:ba:d0:62:0b:7f:e0:ac:29:62:ea:88:e8:0c:c9:44:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoRegisterDriverReinitialization
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
KeDelayExecutionThread
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
IoIsWdmVersionAvailable
IoCreateSymbolicLink
IoCreateDevice
ExAllocatePoolWithTag
ZwSetInformationFile
ZwCreateFile
ZwDeleteFile
ZwWriteFile
ZwSetValueKey
ZwQueryValueKey
_vsnprintf
ZwFlushKey
RtlCopyUnicodeString
MmIsAddressValid
ZwDeleteKey
ZwEnumerateKey
ZwOpenKey
ExFreePoolWithTag
ExFreePool
RtlGetVersion
wcsrchr
KeClearEvent
_wcsnicmp
ObCreateObject
IoFileObjectType
IoDriverObjectType
MmMapLockedPagesSpecifyCache
_vsnwprintf
KeQueryTimeIncrement
IoGetDeviceAttachmentBaseRef
IoFreeIrp
IoAllocateIrp
ObfDereferenceObject
wcsstr
CmRegisterCallback
PsGetCurrentProcessId
CmCallbackGetKeyObjectID
ObOpenObjectByPointer
RtlCompareUnicodeString
strstr
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
IoCancelIrp
MmProbeAndLockPages
IoAllocateMdl
IofCallDriver
ExSystemTimeToLocalTime
RtlTimeToTimeFields
DbgPrint
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1e4beeb2996d81f978c14eb460eed11a

Code Sign

42:1c:b6:de:8a:18:ac:26:c5:2b:2d:f9:8e:52:d1:ebCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

bd:ac:d2:b6:ba:d0:62:0b:7f:e0:ac:29:62:ea:88:e8:0c:c9:44:0cSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 136KB

.pdata Size: 1024B - Virtual size: 1008B

INIT Size: 2KB - Virtual size: 1KB

42:1c:b6:de:8a:18:ac:26:c5:2b:2d:f9:8e:52:d1:eb
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

bd:ac:d2:b6:ba:d0:62:0b:7f:e0:ac:29:62:ea:88:e8:0c:c9:44:0c
Signer

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 136KB

.pdata
Size: 1024B - Virtual size: 1008B

INIT
Size: 2KB - Virtual size: 1KB