iaStorAfsService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

iaStorAfsService.exe
Size

2.8MB
MD5

1f3a4126cfad02209be9719d2bac093b
SHA1

fe6ac7bbf45b3214e1ff786040d73d324376a43c
SHA256

9fc4c665d1245612c24e1c33730971897bd89b3a0c8e090e89f6a827bd1fc477
SHA512

7b7d1962c2889eb05bb3768adec2214cd3d2c6f0fd3abd58da77e3b239f1fc2b4057d1e57e78f9a54b5f308e455bd5b5384900ac02a520b0d71a843660e86b07
SSDEEP

49152:SRGteButBAz7WrdE14/Tw6ahEUUmuRlnVqqznlx++8c:/B87WqQrjyc

Score

1^/10

Malware Config

Signatures

Files

iaStorAfsService.exe
.exe windows:6 windows x64 arch:x64

7a4a94414da602f1ce48584482ee086c

Code Sign

56:00:00:05:da:b0:98:83:13:da:8a:b3:e1:00:00:00:00:05:da
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

02/03/2018, 17:58

Not After

01/03/2020, 17:58

Subject

CN=Intel(R) pGFX,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:bb:ae:0b:49:56:ae:9b:2e:8a:da:11:07:e2:5b:75:4c:61:67:1b
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

05/09/2018, 16:06

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:6C37-9665-74EC,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8e:8e:16:f2:95:7b:8d:54:59:01:62:86:20:c7:d0:0f:bb:a4:9c:4f:9e:54:1e:b5:37:f4:73:52:63:34:2f:20
Signer

Actual PE Digest

8e:8e:16:f2:95:7b:8d:54:59:01:62:86:20:c7:d0:0f:bb:a4:9c:4f:9e:54:1e:b5:37:f4:73:52:63:34:2f:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\7113\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

Imports

fltlib

FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
WaitForSingleObjectEx
LeaveCriticalSection
SetEvent
EnterCriticalSection
TryEnterCriticalSection
ResetEvent
CreateEventW
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
CreateMutexW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
TlsAlloc
GetCurrentProcessId
ExitProcess
TerminateProcess
TlsFree
SetPriorityClass
GetCurrentThreadId
TlsGetValue
CreateThread
ExitThread
GetCurrentProcess
ResumeThread
TlsSetValue
GetStartupInfoW
SuspendThread

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-heap-l1-1-0

HeapCompact
HeapValidate
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapQueryInformation
HeapSize
HeapFree
HeapCreate
HeapAlloc

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
InitializeSid
IsValidSid
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthority
CopySid
EqualSid
GetSidLengthRequired
GetLengthSid

rpcrt4

RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcServerUseProtseqEpW
RpcAsyncAbortCall
RpcAsyncCompleteCall
RpcServerTestCancel
RpcBindingVectorFree
RpcServerInqBindings
RpcServerListen
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
RpcEpUnregister

userenv

UnloadUserProfile

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedFlushSList

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
LoadStringW

api-ms-win-core-file-l1-1-0

GetFullPathNameA
SetEndOfFile
UnlockFileEx
FindFirstFileExW
FindNextFileA
FindClose
CreateFileW
SetFilePointer
WriteFile
DeleteFileW
GetDiskFreeSpaceW
GetFullPathNameW
LockFile
FlushFileBuffers
GetFileSize
GetFinalPathNameByHandleW
GetFileSizeEx
GetDiskFreeSpaceA
FileTimeToLocalFileTime
ReadFile
CompareFileTime
FindFirstFileW
FindNextFileW
CreateDirectoryW
LockFileEx
GetFileAttributesA
GetFileType
SetFilePointerEx
FindFirstFileExA
GetFileAttributesW
SetFileAttributesW
UnlockFile
DeleteFileA
GetFileAttributesExW
CreateFileA

api-ms-win-core-io-l1-1-0

DeviceIoControl
CancelIoEx
GetOverlappedResult

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryValueExW
RegDeleteTreeW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
CoRevokeClassObject

oleaut32

SysAllocString
VariantInit
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString
VariantClear

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
GetTickCount64
GetSystemTime

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer
DeleteTimerQueueEx

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
GetSystemPowerStatus

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
FlushViewOfFile
MapViewOfFile
VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetCPInfo
IsValidLocale
EnumSystemLocalesW
GetOEMCP
GetLocaleInfoW
FormatMessageW
GetACP
GetUserDefaultLCID
IsValidCodePage
FormatMessageA

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-file-l1-2-2

AreFileApisANSI
FindFirstFileNameW
FindNextFileNameW
GetTempPathA

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx
ChangeServiceConfigW
ChangeServiceConfig2W
QueryServiceConfigW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
CreateServiceW
StartServiceW
OpenServiceW
DeleteService

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
GetStdHandle

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
ReadConsoleW
WriteConsoleW

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 559KB - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a4a94414da602f1ce48584482ee086c

Code Sign

56:00:00:05:da:b0:98:83:13:da:8a:b3:e1:00:00:00:00:05:daCertificate

Extended Key Usages

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

62:bb:ae:0b:49:56:ae:9b:2e:8a:da:11:07:e2:5b:75:4c:61:67:1bCertificate

Extended Key Usages

Key Usages

8e:8e:16:f2:95:7b:8d:54:59:01:62:86:20:c7:d0:0f:bb:a4:9c:4f:9e:54:1e:b5:37:f4:73:52:63:34:2f:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

fltlib

shlwapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

userenv

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-core-heap-l2-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l1-2-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-processenvironment-l1-1-0

advapi32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

56:00:00:05:da:b0:98:83:13:da:8a:b3:e1:00:00:00:00:05:da
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

62:bb:ae:0b:49:56:ae:9b:2e:8a:da:11:07:e2:5b:75:4c:61:67:1b
Certificate

8e:8e:16:f2:95:7b:8d:54:59:01:62:86:20:c7:d0:0f:bb:a4:9c:4f:9e:54:1e:b5:37:f4:73:52:63:34:2f:20
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 559KB - Virtual size: 559KB

.data
Size: 41KB - Virtual size: 53KB

.pdata
Size: 114KB - Virtual size: 113KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 12KB - Virtual size: 12KB