382b70ad2bb9ffb06f91355ba0227391

Sharing

Copy URL Twitter E-mail

General

Target

382b70ad2bb9ffb06f91355ba0227391
Size

76KB
MD5

382b70ad2bb9ffb06f91355ba0227391
SHA1

a4367c6d1de4047410985bddc069917a0bc81cd8
SHA256

94cc9a79cf608dd8df66ded2de0fd70b457ce6448861e9e6e352b52d492d4a30
SHA512

0478fc7314eab2c8444b286720b6d14fcd6094c27a3f8090d6bfc75fe7dc4e4df75495284eef79fe877f74fc58f905520b6ffaeb4cc1b920b609f9f74cc1f9eb
SSDEEP

1536:zGKjLMDjwSbXMcJVK9ehVgV7tbE3krIjkOHm/a:bLMP/zkqq/HrIj18a

Score

1^/10

Malware Config

Signatures

Files

382b70ad2bb9ffb06f91355ba0227391
.sys windows:6 windows x64 arch:x64

22602cf9c9696e7b40d9844e9d493520

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:e7:3b:07:6f:69:a2:8f:f5:45:c4:ef
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

20/06/2019, 08:29

Not After

20/09/2022, 08:29

Subject

SERIALNUMBER=313237333200048,CN=Sidorov Vitaly Viktorovich IP,O=Sidorov Vitaly Viktorovich IP,STREET=117A Lunacharskogo Ul.,L=Novotitarovskaya,ST=Krasnodar Krai,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130e4b7261736e6f646172204b726169,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:99:ae:10:6d:da:bd:32:5e:20:1b:8d:c4:f5:8d:86:3f:93:04:b6:f9:29:90:ff:e7:60:6a:17:48:fe:a0:4f
Signer

Actual PE Digest

89:99:ae:10:6d:da:bd:32:5e:20:1b:8d:c4:f5:8d:86:3f:93:04:b6:f9:29:90:ff:e7:60:6a:17:48:fe:a0:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeBugCheckEx
ExUuidCreate
swprintf_s
RtlCreateSecurityDescriptor
RtlLengthSid
IoAllocateMdl
ObOpenObjectByPointer
IoReleaseCancelSpinLock
IoCreateDevice
MmFreePagesFromMdl
ObfDereferenceObject
PsGetCurrentProcessId
IoCreateSymbolicLink
SeExports
ZwSetSecurityObject
KeWaitForSingleObject
ObReferenceObjectByHandle
ZwSetInformationThread
IofCompleteRequest
PsTerminateSystemThread
ZwQueryValueKey
MmMapLockedPagesSpecifyCache
PsCreateSystemThread
RtlAddAccessAllowedAce
MmBuildMdlForNonPagedPool
MmAllocatePagesForMdl
KeInitializeEvent
RtlAppendUnicodeToString
MmGetSystemRoutineAddress
KeSetEvent
IoDeleteDevice
RtlSetDaclSecurityDescriptor
PsLookupProcessByProcessId
RtlCreateAcl
IoDeleteSymbolicLink
MmUnmapLockedPages
RtlCompareMemory
RtlValidSid
ExDeleteNPagedLookasideList
ExQueryDepthSList
IoFreeMdl
ExpInterlockedPopEntrySList
KeAcquireInStackQueuedSpinLock
ExpInterlockedPushEntrySList
KeReleaseInStackQueuedSpinLock
ExInitializeNPagedLookasideList
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwOpenKey
ZwClose
RtlInitUnicodeString
__C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpmSubLayerAdd0
FwpsQueryPacketInjectionState0
FwpmSubLayerDeleteByKey0
FwpmSubLayerEnum0
FwpmTransactionCommit0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmProviderContextDeleteByKey0
FwpmCalloutAdd0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmEngineOpen0
FwpsAcquireClassifyHandle0
FwpmFilterAdd0
FwpsPendClassify0
FwpsCalloutRegister1
FwpmTransactionBegin0
FwpmEngineClose0
FwpmFreeMemory0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectNetworkReceiveAsync0
FwpsFreeCloneNetBufferList0
FwpsInjectionHandleDestroy0
FwpsConstructIpHeaderForTransportPacket0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectionHandleCreate0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkSendAsync0
FwpsCopyStreamDataToBuffer0
FwpsInjectTransportSendAsync0
FwpsFlowRemoveContext0
FwpsCloneStreamData0
FwpsCompleteClassify0
FwpsStreamInjectAsync0
FwpsReleaseClassifyHandle0
FwpsDiscardClonedStreamData0
FwpsFreeNetBufferList0
FwpmBfeStateUnsubscribeChanges0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0

ndis.sys

NdisAllocateGenericObject
NdisWaitEvent
NdisAllocateNetBufferListPool
NdisInitializeEvent
NdisFreeGenericObject
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22602cf9c9696e7b40d9844e9d493520

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

68:e7:3b:07:6f:69:a2:8f:f5:45:c4:efCertificate

Extended Key Usages

Key Usages

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

89:99:ae:10:6d:da:bd:32:5e:20:1b:8d:c4:f5:8d:86:3f:93:04:b6:f9:29:90:ff:e7:60:6a:17:48:fe:a0:4fSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

fwpkclnt.sys

ndis.sys

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 4KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 512B - Virtual size: 494B

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

68:e7:3b:07:6f:69:a2:8f:f5:45:c4:ef
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

89:99:ae:10:6d:da:bd:32:5e:20:1b:8d:c4:f5:8d:86:3f:93:04:b6:f9:29:90:ff:e7:60:6a:17:48:fe:a0:4f
Signer

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 512B - Virtual size: 494B