663c9d98bcd890fcfeba20805db62977

Sharing

Copy URL Twitter E-mail

General

Target

663c9d98bcd890fcfeba20805db62977
Size

21KB
MD5

663c9d98bcd890fcfeba20805db62977
SHA1

e9841fcda85e87ce69b8d0b46b9dc97642b2219c
SHA256

49ffb7ff632f4d2bc5b9bfd084a339b6d0f0b0de635a935ba478521881512573
SHA512

9dbbe21a1735f2f60757ac602049c70a6feb0d854062901081f90346f2913324d5920b77f5d39aae14a963c91fc4dd4d5e997c4a9ab3b1cf0c7ff2d91c854d26
SSDEEP

384:K/YAcq3KlzMOIPr1YBiTHxjGMYJLWaJibW6j3:K/TBOIGiTHxqBLebWm3

Score

1^/10

Malware Config

Signatures

Files

663c9d98bcd890fcfeba20805db62977
.sys windows:6 windows x86 arch:x86

6a2a8e4bbe6235d623561435cd2df042

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:dd:29:68:2f:3f:db:17:9f:55:55:c5:43:3b:40:22
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/11/2007, 00:00

Not After

23/01/2011, 23:59

Subject

CN=2Squared Software,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=2Squared Software,ST=Nevada,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:46:7d:46:bc:66:70:f5:df:c6:1f:fe:8f:58:64:c6:07:aa:98:4d
Signer

Actual PE Digest

45:46:7d:46:bc:66:70:f5:df:c6:1f:fe:8f:58:64:c6:07:aa:98:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExInitializeNPagedLookasideList
IofCallDriver
ExInterlockedPushEntrySList
KeTickCount
ObfDereferenceObject
IoQueueWorkItem
IoRegisterFsRegistrationChange
IoAllocateWorkItem
IoFreeWorkItem
ExAllocatePoolWithTag
ExQueueWorkItem
ZwReadFile
ZwWriteFile
IoThreadToProcess
PsGetProcessId
RtlInitUnicodeString
RtlCompareUnicodeString
ZwOpenProcess
ZwQueryInformationProcess
ZwClose
memcpy
memset
ExAllocatePool
ExFreePoolWithTag
IoUnregisterFsRegistrationChange
IoDetachDevice
IoDeleteDevice
ExDeleteNPagedLookasideList
IoCreateDevice
ExInterlockedPopEntrySList
IoAttachDeviceToDeviceStackSafe
RtlUnwind
KeBugCheckEx

hal

KfReleaseSpinLock
KfAcquireSpinLock

fltmgr.sys

FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltFreeSecurityDescriptor
FltStartFiltering
FltEnumerateVolumes
FltGetBottomInstance
FltGetVolumeFromName
FltGetDeviceObject
FltGetVolumeName
FltCreateFile
FltClose
FltGetVolumeFromDeviceObject
FltAttachVolume
FltObjectDereference
FltCancelFileOpen
FltGetFileNameInformation
FltReleaseFileNameInformation
FltSendMessage
FltCloseCommunicationPort
FltUnregisterFilter
FltCloseClientPort
FltRegisterFilter

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 768B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a2a8e4bbe6235d623561435cd2df042

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

05:dd:29:68:2f:3f:db:17:9f:55:55:c5:43:3b:40:22Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

45:46:7d:46:bc:66:70:f5:df:c6:1f:fe:8f:58:64:c6:07:aa:98:4dSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

fltmgr.sys

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 640B - Virtual size: 612B

.data Size: 768B - Virtual size: 728B

PAGE Size: 7KB - Virtual size: 7KB

INIT Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 928B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

05:dd:29:68:2f:3f:db:17:9f:55:55:c5:43:3b:40:22
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

45:46:7d:46:bc:66:70:f5:df:c6:1f:fe:8f:58:64:c6:07:aa:98:4d
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 640B - Virtual size: 612B

.data
Size: 768B - Virtual size: 728B

PAGE
Size: 7KB - Virtual size: 7KB

INIT
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 928B