bba677bfc468e00f289efbc65fb233e6

Sharing

Copy URL Twitter E-mail

General

Target

bba677bfc468e00f289efbc65fb233e6
Size

2.2MB
MD5

bba677bfc468e00f289efbc65fb233e6
SHA1

d2b7308e6d20c7c9335033a0cc4b2e5889ffb6b9
SHA256

717039e54f2051d6efa291d1b727c7885fe032eccaf033badad424bae5b0aed5
SHA512

bfe780daedcf8ae965d68c5a3a444e82e6211c7134a4b281aa32127ecacf5f877b82bb632594c4b51e9973f02c1f8bbe1d0dea480a18154c6d7e147b1ca0435e
SSDEEP

49152:jBFAOevcIIwuTf5v3dHs83kcaVQn/k/65eG4QXlindDY:NFA+IEvdHs8ua/khGbVuDY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/EFI/efi/PasswareBootableMemoryImager.efi

Files

bba677bfc468e00f289efbc65fb233e6
.zip
EFI/BOOT/BOOTX64.EFI
.exe windows:0 windows x64 arch:x64

Code Sign

33:00:00:00:10:a4:91:29:43:d9:4c:e6:2e:00:01:00:00:00:10
Certificate

Issuer

CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:02

Not After

01/01/2016, 18:02

Subject

CN=Microsoft Windows UEFI Driver Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:08:d3:c4:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Corporation Third Party Marketplace Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/06/2011, 21:22

Not After

27/06/2026, 21:32

Subject

CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:af:9e:05:6d:3d:5b:38:b6:85:53:30:4a:bc:88:82:7e:bc:00:f8:0c:b9:c7:e1:97:cd:bc:58:22:cd:31:6c
Signer

Actual PE Digest

db:af:9e:05:6d:3d:5b:38:b6:85:53:30:4a:bc:88:82:7e:bc:00:f8:0c:b9:c7:e1:97:cd:bc:58:22:cd:31:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

/4
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 640KB - Virtual size: 640KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/14
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynamic
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rela
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynsym
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EFI/BOOT/MokManager.efi
.exe windows:0 windows x64 arch:x64

Code Sign

99:76:f7:0f
Certificate

Issuer

CN=Fedora Secure Boot CA

Not Before

07/12/2012, 15:38

Not After

05/12/2022, 15:38

Subject

CN=Fedora Secure Boot Signer

Extended Key Usages

ExtKeyUsageCodeSigning

99:76:f2:f4
Certificate

Issuer

CN=Fedora Secure Boot CA

Not Before

07/12/2012, 16:25

Not After

05/12/2022, 16:25

Subject

CN=Fedora Secure Boot CA

Extended Key Usages

ExtKeyUsageCodeSigning

b6:83:62:d4:6c:07:0b:f8:c4:4f:d5:09:53:23:e1:41:49:42:66:3d:9d:29:60:26:15:fd:b9:9d:ba:bf:44:b2
Signer

Actual PE Digest

b6:83:62:d4:6c:07:0b:f8:c4:4f:d5:09:53:23:e1:41:49:42:66:3d:9d:29:60:26:15:fd:b9:9d:ba:bf:44:b2

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

/4
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dynamic
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rela
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynsym
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EFI/BOOT/grubx64.efi
.exe windows:0 windows x64 arch:x64

Code Sign

10:04:b1:1d:d9:a9:a3:06:a4:87:5b:73:be:1c:ce:39:91:04:c4:33
Certificate

Issuer

CN=Passware UEFI Memory Imager,OU=\ \ ,O=\ \ ,L=\ \ ,ST=\ \ ,C=\ \

Not Before

11/12/2020, 10:59

Not After

11/12/2021, 10:59

Subject

CN=Passware UEFI Memory Imager,OU=\ \ ,O=\ \ ,L=\ \ ,ST=\ \ ,C=\ \

c0:eb:b5:88:fd:49:c9:d4:7d:c2:2c:09:6f:24:36:1c:05:28:d9:d9:df:0b:34:db:08:1c:59:6b:02:92:8d:e5
Signer

Actual PE Digest

c0:eb:b5:88:fd:49:c9:d4:7d:c2:2c:09:6f:24:36:1c:05:28:d9:d9:df:0b:34:db:08:1c:59:6b:02:92:8d:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dynamic
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rela
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynsym
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EFI/BOOT/grubx64_real.efi
.exe windows:0 windows x64 arch:x64

Code Sign

10:04:b1:1d:d9:a9:a3:06:a4:87:5b:73:be:1c:ce:39:91:04:c4:33
Certificate

Issuer

CN=Passware UEFI Memory Imager,OU=\ \ ,O=\ \ ,L=\ \ ,ST=\ \ ,C=\ \

Not Before

11/12/2020, 10:59

Not After

11/12/2021, 10:59

Subject

CN=Passware UEFI Memory Imager,OU=\ \ ,O=\ \ ,L=\ \ ,ST=\ \ ,C=\ \

01:6e:e7:87:8d:32:22:42:66:f0:fd:b8:1b:d3:7c:8e:ef:cf:23:cc:26:25:c0:40:49:12:2d:d0:78:be:c1:42
Signer

Actual PE Digest

01:6e:e7:87:8d:32:22:42:66:f0:fd:b8:1b:d3:7c:8e:ef:cf:23:cc:26:25:c0:40:49:12:2d:d0:78:be:c1:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mods
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EFI/BOOT/mmia32.efi
.exe windows:0 windows x86 arch:x86

Code Sign

99:76:f7:0f
Certificate

Issuer

CN=Fedora Secure Boot CA

Not Before

07/12/2012, 15:38

Not After

05/12/2022, 15:38

Subject

CN=Fedora Secure Boot Signer

Extended Key Usages

ExtKeyUsageCodeSigning

99:76:f2:f4
Certificate

Issuer

CN=Fedora Secure Boot CA

Not Before

07/12/2012, 16:25

Not After

05/12/2022, 16:25

Subject

CN=Fedora Secure Boot CA

Extended Key Usages

ExtKeyUsageCodeSigning

71:91:04:da:1d:bd:13:d4:81:ae:6c:a4:6a:ec:cb:04:7c:d7:59:59:23:99:14:9a:99:d5:a0:74:b3:ef:0b:e4
Signer

Actual PE Digest

71:91:04:da:1d:bd:13:d4:81:ae:6c:a4:6a:ec:cb:04:7c:d7:59:59:23:99:14:9a:99:d5:a0:74:b3:ef:0b:e4

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 569KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dynamic
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rel
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rel.plt
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynsym
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EFI/efi/PasswareBootableMemoryImager.efi
.dll windows:0 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 64B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EFI/grub/grub.cfg
EFI/grub/x86_64-efi/acpi.mod
.xz
acpi
.elf linux x64
EFI/grub/x86_64-efi/adler32.mod
.xz
adler32
.elf linux x64
EFI/grub/x86_64-efi/affs.mod
.xz
affs
.elf linux x64
EFI/grub/x86_64-efi/afs.mod
.xz
afs
.elf linux x64
EFI/grub/x86_64-efi/ahci.mod
.xz
ahci
.elf linux x64
EFI/grub/x86_64-efi/all_video.mod
.xz
all_video
.elf linux x64
EFI/grub/x86_64-efi/aout.mod
.xz
aout
.elf linux x64
EFI/grub/x86_64-efi/appleldr.mod
.xz
appleldr
.elf linux x64
EFI/grub/x86_64-efi/archelp.mod
.xz
EFI/grub/x86_64-efi/at_keyboard.mod
.xz
EFI/grub/x86_64-efi/ata.mod
.xz
EFI/grub/x86_64-efi/backtrace.mod
.xz
EFI/grub/x86_64-efi/bfs.mod
.xz
EFI/grub/x86_64-efi/bitmap.mod
.xz
EFI/grub/x86_64-efi/bitmap_scale.mod
.xz
EFI/grub/x86_64-efi/blocklist.mod
.xz
EFI/grub/x86_64-efi/blscfg.mod
.xz
EFI/grub/x86_64-efi/boot.mod
.xz
EFI/grub/x86_64-efi/bsd.mod
.xz
EFI/grub/x86_64-efi/bswap_test.mod
.xz
EFI/grub/x86_64-efi/btrfs.mod
.xz
EFI/grub/x86_64-efi/bufio.mod
.xz
EFI/grub/x86_64-efi/cat.mod
.xz
EFI/grub/x86_64-efi/cbfs.mod
.xz
EFI/grub/x86_64-efi/cbls.mod
.xz
EFI/grub/x86_64-efi/cbmemc.mod
.xz
EFI/grub/x86_64-efi/cbtable.mod
.xz
EFI/grub/x86_64-efi/cbtime.mod
.xz
EFI/grub/x86_64-efi/chain.mod
.xz
EFI/grub/x86_64-efi/cmdline_cat_test.mod
.xz
EFI/grub/x86_64-efi/cmp.mod
.xz
EFI/grub/x86_64-efi/cmp_test.mod
.xz
EFI/grub/x86_64-efi/command.lst
.xz
EFI/grub/x86_64-efi/configfile.mod
.xz
EFI/grub/x86_64-efi/cpio.mod
.xz
EFI/grub/x86_64-efi/cpio_be.mod
.xz
EFI/grub/x86_64-efi/cpuid.mod
.xz
EFI/grub/x86_64-efi/crc64.mod
.xz
EFI/grub/x86_64-efi/crypto.lst
.xz
EFI/grub/x86_64-efi/crypto.mod
.xz
EFI/grub/x86_64-efi/cryptodisk.mod
.xz
EFI/grub/x86_64-efi/cs5536.mod
.xz
EFI/grub/x86_64-efi/ctz_test.mod
.xz
EFI/grub/x86_64-efi/date.mod
.xz
EFI/grub/x86_64-efi/datehook.mod
.xz
EFI/grub/x86_64-efi/datetime.mod
.xz
EFI/grub/x86_64-efi/disk.mod
.xz
EFI/grub/x86_64-efi/diskfilter.mod
.xz
EFI/grub/x86_64-efi/div.mod
.xz
EFI/grub/x86_64-efi/div_test.mod
.xz
EFI/grub/x86_64-efi/dm_nv.mod
.xz
EFI/grub/x86_64-efi/echo.mod
.xz
EFI/grub/x86_64-efi/efi_gop.mod
.xz
EFI/grub/x86_64-efi/efi_netfs.mod
.xz
EFI/grub/x86_64-efi/efi_uga.mod
.xz
EFI/grub/x86_64-efi/efifwsetup.mod
.xz
EFI/grub/x86_64-efi/efinet.mod
.xz
EFI/grub/x86_64-efi/ehci.mod
.xz
EFI/grub/x86_64-efi/elf.mod
.xz
EFI/grub/x86_64-efi/eval.mod
.xz
EFI/grub/x86_64-efi/exfat.mod
.xz
EFI/grub/x86_64-efi/exfctest.mod
.xz
EFI/grub/x86_64-efi/ext2.mod
.xz
EFI/grub/x86_64-efi/extcmd.mod
.xz
EFI/grub/x86_64-efi/f2fs.mod
.xz
EFI/grub/x86_64-efi/fat.mod
.xz
EFI/grub/x86_64-efi/fdt.lst
.xz
EFI/grub/x86_64-efi/file.mod
.xz
EFI/grub/x86_64-efi/fixvideo.mod
.xz
EFI/grub/x86_64-efi/font.mod
.xz
EFI/grub/x86_64-efi/fs.lst
.xz
EFI/grub/x86_64-efi/fshelp.mod
.xz
EFI/grub/x86_64-efi/functional_test.mod
.xz
EFI/grub/x86_64-efi/gcry_arcfour.mod
.xz
EFI/grub/x86_64-efi/gcry_blowfish.mod
.xz
EFI/grub/x86_64-efi/gcry_camellia.mod
.xz
EFI/grub/x86_64-efi/gcry_cast5.mod
.xz
EFI/grub/x86_64-efi/gcry_crc.mod
.xz
EFI/grub/x86_64-efi/gcry_des.mod
.xz
EFI/grub/x86_64-efi/gcry_dsa.mod
.xz
EFI/grub/x86_64-efi/gcry_idea.mod
.xz
EFI/grub/x86_64-efi/gcry_md4.mod
.xz
EFI/grub/x86_64-efi/gcry_md5.mod
.xz
EFI/grub/x86_64-efi/gcry_rfc2268.mod
.xz
EFI/grub/x86_64-efi/gcry_rijndael.mod
.xz
EFI/grub/x86_64-efi/gcry_rmd160.mod
.xz
EFI/grub/x86_64-efi/gcry_rsa.mod
.xz
EFI/grub/x86_64-efi/gcry_seed.mod
.xz
EFI/grub/x86_64-efi/gcry_serpent.mod
.xz
EFI/grub/x86_64-efi/gcry_sha1.mod
.xz
EFI/grub/x86_64-efi/gcry_sha256.mod
.xz
EFI/grub/x86_64-efi/gcry_sha512.mod
.xz
EFI/grub/x86_64-efi/gcry_tiger.mod
.xz
EFI/grub/x86_64-efi/gcry_twofish.mod
.xz
EFI/grub/x86_64-efi/gcry_whirlpool.mod
.xz
EFI/grub/x86_64-efi/geli.mod
.xz
EFI/grub/x86_64-efi/gettext.mod
.xz
EFI/grub/x86_64-efi/gfxmenu.mod
.xz
EFI/grub/x86_64-efi/gfxterm.mod
.xz
EFI/grub/x86_64-efi/gfxterm_background.mod
.xz
EFI/grub/x86_64-efi/gfxterm_menu.mod
.xz
EFI/grub/x86_64-efi/gmodule.pl
.xz
EFI/grub/x86_64-efi/gptsync.mod
.xz
EFI/grub/x86_64-efi/gzio.mod
.xz
EFI/grub/x86_64-efi/halt.mod
.xz
EFI/grub/x86_64-efi/hashsum.mod
.xz
EFI/grub/x86_64-efi/hdparm.mod
.xz
EFI/grub/x86_64-efi/hello.mod
.xz
EFI/grub/x86_64-efi/help.mod
.xz
EFI/grub/x86_64-efi/hexdump.mod
.xz
EFI/grub/x86_64-efi/hfs.mod
.xz
EFI/grub/x86_64-efi/hfsplus.mod
.xz
EFI/grub/x86_64-efi/hfspluscomp.mod
.xz
EFI/grub/x86_64-efi/http.mod
.xz
EFI/grub/x86_64-efi/increment.mod
.xz
EFI/grub/x86_64-efi/iorw.mod
.xz
EFI/grub/x86_64-efi/iso9660.mod
.xz
EFI/grub/x86_64-efi/jfs.mod
.xz
EFI/grub/x86_64-efi/jpeg.mod
.xz
EFI/grub/x86_64-efi/keylayouts.mod
.xz
EFI/grub/x86_64-efi/keystatus.mod
.xz
EFI/grub/x86_64-efi/ldm.mod
.xz
EFI/grub/x86_64-efi/legacy_password_test.mod
.xz
EFI/grub/x86_64-efi/legacycfg.mod
.xz
EFI/grub/x86_64-efi/linux.mod
.xz
EFI/grub/x86_64-efi/linuxefi.mod
.xz
EFI/grub/x86_64-efi/loadbios.mod
.xz
EFI/grub/x86_64-efi/loadenv.mod
.xz
EFI/grub/x86_64-efi/loopback.mod
.xz
EFI/grub/x86_64-efi/ls.mod
.xz
EFI/grub/x86_64-efi/lsacpi.mod
.xz
EFI/grub/x86_64-efi/lsefi.mod
.xz
EFI/grub/x86_64-efi/lsefimmap.mod
.xz
EFI/grub/x86_64-efi/lsefisystab.mod
.xz
EFI/grub/x86_64-efi/lsmmap.mod
.xz
EFI/grub/x86_64-efi/lspci.mod
.xz
EFI/grub/x86_64-efi/lssal.mod
.xz
EFI/grub/x86_64-efi/luks.mod
.xz
EFI/grub/x86_64-efi/lvm.mod
.xz
EFI/grub/x86_64-efi/lzopio.mod
.xz
EFI/grub/x86_64-efi/macbless.mod
.xz
EFI/grub/x86_64-efi/macho.mod
.xz
EFI/grub/x86_64-efi/mdraid09.mod
.xz
EFI/grub/x86_64-efi/mdraid09_be.mod
.xz
EFI/grub/x86_64-efi/mdraid1x.mod
.xz
EFI/grub/x86_64-efi/memdisk.mod
.xz
EFI/grub/x86_64-efi/memrw.mod
.xz
EFI/grub/x86_64-efi/minicmd.mod
.xz
EFI/grub/x86_64-efi/minix.mod
.xz
EFI/grub/x86_64-efi/minix2.mod
.xz
EFI/grub/x86_64-efi/minix2_be.mod
.xz
EFI/grub/x86_64-efi/minix3.mod
.xz
EFI/grub/x86_64-efi/minix3_be.mod
.xz
EFI/grub/x86_64-efi/minix_be.mod
.xz
EFI/grub/x86_64-efi/mmap.mod
.xz
EFI/grub/x86_64-efi/moddep.lst
.xz
EFI/grub/x86_64-efi/modinfo.sh
.xz
EFI/grub/x86_64-efi/morse.mod
.xz
EFI/grub/x86_64-efi/mpi.mod
.xz
EFI/grub/x86_64-efi/msdospart.mod
.xz
EFI/grub/x86_64-efi/mul_test.mod
.xz
EFI/grub/x86_64-efi/nativedisk.mod
.xz
EFI/grub/x86_64-efi/net.mod
.xz
EFI/grub/x86_64-efi/newc.mod
.xz
EFI/grub/x86_64-efi/nilfs2.mod
.xz
EFI/grub/x86_64-efi/normal.mod
.xz
EFI/grub/x86_64-efi/ntfs.mod
.xz
EFI/grub/x86_64-efi/ntfscomp.mod
.xz
EFI/grub/x86_64-efi/odc.mod
.xz
EFI/grub/x86_64-efi/offsetio.mod
.xz
EFI/grub/x86_64-efi/ohci.mod
.xz
EFI/grub/x86_64-efi/part_acorn.mod
.xz
EFI/grub/x86_64-efi/part_amiga.mod
.xz
EFI/grub/x86_64-efi/part_apple.mod
.xz
EFI/grub/x86_64-efi/part_bsd.mod
.xz
EFI/grub/x86_64-efi/part_dfly.mod
.xz
EFI/grub/x86_64-efi/part_dvh.mod
.xz
EFI/grub/x86_64-efi/part_gpt.mod
.xz
EFI/grub/x86_64-efi/part_msdos.mod
.xz
EFI/grub/x86_64-efi/part_plan.mod
.xz
EFI/grub/x86_64-efi/part_sun.mod
.xz
EFI/grub/x86_64-efi/part_sunpc.mod
.xz
EFI/grub/x86_64-efi/partmap.lst
.xz
EFI/grub/x86_64-efi/parttool.lst
.xz
EFI/grub/x86_64-efi/parttool.mod
.xz
EFI/grub/x86_64-efi/password.mod
.xz
EFI/grub/x86_64-efi/password_pbkdf2.mod
.xz
EFI/grub/x86_64-efi/pata.mod
.xz
EFI/grub/x86_64-efi/pbkdf2.mod
.xz
EFI/grub/x86_64-efi/pbkdf2_test.mod
.xz
EFI/grub/x86_64-efi/pcidump.mod
.xz
EFI/grub/x86_64-efi/play.mod
.xz
EFI/grub/x86_64-efi/png.mod
.xz
EFI/grub/x86_64-efi/priority_queue.mod
.xz
EFI/grub/x86_64-efi/probe.mod
.xz
EFI/grub/x86_64-efi/procfs.mod
.xz
EFI/grub/x86_64-efi/progress.mod
.xz
EFI/grub/x86_64-efi/raid5rec.mod
.xz
EFI/grub/x86_64-efi/raid6rec.mod
.xz
EFI/grub/x86_64-efi/random.mod
.xz
EFI/grub/x86_64-efi/read.mod
.xz
EFI/grub/x86_64-efi/reboot.mod
.xz
EFI/grub/x86_64-efi/regexp.mod
.xz
EFI/grub/x86_64-efi/reiserfs.mod
.xz
EFI/grub/x86_64-efi/relocator.mod
.xz
EFI/grub/x86_64-efi/romfs.mod
.xz
EFI/grub/x86_64-efi/scsi.mod
.xz
EFI/grub/x86_64-efi/search.mod
.xz
EFI/grub/x86_64-efi/search_fs_file.mod
.xz
EFI/grub/x86_64-efi/search_fs_uuid.mod
.xz
EFI/grub/x86_64-efi/search_label.mod
.xz
EFI/grub/x86_64-efi/serial.mod
.xz
EFI/grub/x86_64-efi/setjmp.mod
.xz
EFI/grub/x86_64-efi/setjmp_test.mod
.xz
EFI/grub/x86_64-efi/setpci.mod
.xz
EFI/grub/x86_64-efi/sfs.mod
.xz
EFI/grub/x86_64-efi/shift_test.mod
.xz
EFI/grub/x86_64-efi/signature_test.mod
.xz
EFI/grub/x86_64-efi/sleep.mod
.xz
EFI/grub/x86_64-efi/sleep_test.mod
.xz
EFI/grub/x86_64-efi/spkmodem.mod
.xz
EFI/grub/x86_64-efi/squash4.mod
.xz
EFI/grub/x86_64-efi/strtoull_test.mod
.xz
EFI/grub/x86_64-efi/syslinuxcfg.mod
.xz
EFI/grub/x86_64-efi/tar.mod
.xz
EFI/grub/x86_64-efi/terminal.lst
.xz
EFI/grub/x86_64-efi/terminal.mod
.xz
EFI/grub/x86_64-efi/terminfo.mod
.xz
EFI/grub/x86_64-efi/test.mod
.xz
EFI/grub/x86_64-efi/test_blockarg.mod
.xz
EFI/grub/x86_64-efi/testload.mod
.xz
EFI/grub/x86_64-efi/testspeed.mod
.xz
EFI/grub/x86_64-efi/tftp.mod
.xz
EFI/grub/x86_64-efi/tga.mod
.xz
EFI/grub/x86_64-efi/time.mod
.xz
EFI/grub/x86_64-efi/tr.mod
.xz
EFI/grub/x86_64-efi/trig.mod
.xz
EFI/grub/x86_64-efi/true.mod
.xz
EFI/grub/x86_64-efi/udf.mod
.xz
EFI/grub/x86_64-efi/ufs1.mod
.xz
EFI/grub/x86_64-efi/ufs1_be.mod
.xz
EFI/grub/x86_64-efi/ufs2.mod
.xz
EFI/grub/x86_64-efi/uhci.mod
.xz
EFI/grub/x86_64-efi/usb.mod
.xz
EFI/grub/x86_64-efi/usb_keyboard.mod
.xz
EFI/grub/x86_64-efi/usbms.mod
.xz
EFI/grub/x86_64-efi/usbserial_common.mod
.xz
EFI/grub/x86_64-efi/usbserial_ftdi.mod
.xz
EFI/grub/x86_64-efi/usbserial_pl2303.mod
.xz
EFI/grub/x86_64-efi/usbserial_usbdebug.mod
.xz
EFI/grub/x86_64-efi/usbtest.mod
.xz
EFI/grub/x86_64-efi/verify.mod
.xz
EFI/grub/x86_64-efi/version.mod
.xz
EFI/grub/x86_64-efi/video.lst
.xz
EFI/grub/x86_64-efi/video.mod
.xz
EFI/grub/x86_64-efi/video_bochs.mod
.xz
EFI/grub/x86_64-efi/video_cirrus.mod
.xz
EFI/grub/x86_64-efi/video_colors.mod
.xz
EFI/grub/x86_64-efi/video_fb.mod
.xz
EFI/grub/x86_64-efi/videoinfo.mod
.xz
EFI/grub/x86_64-efi/videotest.mod
.xz
EFI/grub/x86_64-efi/videotest_checksum.mod
.xz
EFI/grub/x86_64-efi/xfs.mod
.xz
EFI/grub/x86_64-efi/xnu.mod
.xz
EFI/grub/x86_64-efi/xnu_uuid.mod
.xz
EFI/grub/x86_64-efi/xnu_uuid_test.mod
.xz
EFI/grub/x86_64-efi/xzio.mod
.xz
EFI/grub/x86_64-efi/zfs.mod
.xz
EFI/grub/x86_64-efi/zfscrypt.mod
.xz
EFI/grub/x86_64-efi/zfsinfo.mod
.xz

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:00:10:a4:91:29:43:d9:4c:e6:2e:00:01:00:00:00:10Certificate

Extended Key Usages

61:08:d3:c4:00:00:00:00:00:04Certificate

Key Usages

db:af:9e:05:6d:3d:5b:38:b6:85:53:30:4a:bc:88:82:7e:bc:00:f8:0c:b9:c7:e1:97:cd:bc:58:22:cd:31:6cSigner

Headers

File Characteristics

Sections

/4 Size: 89KB - Virtual size: 88KB

.text Size: 640KB - Virtual size: 640KB

.reloc Size: 512B - Virtual size: 10B

.data Size: 182KB - Virtual size: 182KB

/14 Size: 1KB - Virtual size: 1KB

.dynamic Size: 512B - Virtual size: 240B

.rela Size: 165KB - Virtual size: 165KB

.dynsym Size: 57KB - Virtual size: 56KB

Code Sign

99:76:f7:0fCertificate

Extended Key Usages

99:76:f2:f4Certificate

Extended Key Usages

b6:83:62:d4:6c:07:0b:f8:c4:4f:d5:09:53:23:e1:41:49:42:66:3d:9d:29:60:26:15:fd:b9:9d:ba:bf:44:b2Signer

Headers

File Characteristics

Sections

/4 Size: 94KB - Virtual size: 94KB

.text Size: 580KB - Virtual size: 580KB

.reloc Size: 512B - Virtual size: 10B

.data Size: 169KB - Virtual size: 169KB

.dynamic Size: 512B - Virtual size: 304B

.rela Size: 107KB - Virtual size: 107KB

/14 Size: 512B - Virtual size: 24B

.dynsym Size: 58KB - Virtual size: 58KB

Code Sign

10:04:b1:1d:d9:a9:a3:06:a4:87:5b:73:be:1c:ce:39:91:04:c4:33Certificate

c0:eb:b5:88:fd:49:c9:d4:7d:c2:2c:09:6f:24:36:1c:05:28:d9:d9:df:0b:34:db:08:1c:59:6b:02:92:8d:e5Signer

Headers

File Characteristics

Sections

.text Size: 31KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 10B

.data Size: 10KB - Virtual size: 10KB

.dynamic Size: 512B - Virtual size: 256B

.rela Size: 4KB - Virtual size: 4KB

.dynsym Size: 1KB - Virtual size: 1KB

Code Sign

10:04:b1:1d:d9:a9:a3:06:a4:87:5b:73:be:1c:ce:39:91:04:c4:33Certificate

01:6e:e7:87:8d:32:22:42:66:f0:fd:b8:1b:d3:7c:8e:ef:cf:23:cc:26:25:c0:40:49:12:2d:d0:78:be:c1:42Signer

Headers

File Characteristics

Sections

.text Size: 88KB - Virtual size: 88KB

.data Size: 64KB - Virtual size: 64KB

mods Size: 369KB - Virtual size: 369KB

.reloc Size: 5KB - Virtual size: 5KB

Code Sign

99:76:f7:0fCertificate

Extended Key Usages

99:76:f2:f4Certificate

Extended Key Usages

71:91:04:da:1d:bd:13:d4:81:ae:6c:a4:6a:ec:cb:04:7c:d7:59:59:23:99:14:9a:99:d5:a0:74:b3:ef:0b:e4Signer

Headers

File Characteristics

Sections

.text Size: 569KB - Virtual size: 568KB

.reloc Size: 512B - Virtual size: 10B

.data Size: 134KB - Virtual size: 133KB

.dynamic Size: 512B - Virtual size: 152B

.rel Size: 36KB - Virtual size: 35KB

.rel.plt Size: 512B - Virtual size: 8B

.dynsym Size: 39KB - Virtual size: 38KB

Headers

DLL Characteristics

File Characteristics

33:00:00:00:10:a4:91:29:43:d9:4c:e6:2e:00:01:00:00:00:10
Certificate

61:08:d3:c4:00:00:00:00:00:04
Certificate

db:af:9e:05:6d:3d:5b:38:b6:85:53:30:4a:bc:88:82:7e:bc:00:f8:0c:b9:c7:e1:97:cd:bc:58:22:cd:31:6c
Signer

/4
Size: 89KB - Virtual size: 88KB

.text
Size: 640KB - Virtual size: 640KB

.reloc
Size: 512B - Virtual size: 10B

.data
Size: 182KB - Virtual size: 182KB

/14
Size: 1KB - Virtual size: 1KB

.dynamic
Size: 512B - Virtual size: 240B

.rela
Size: 165KB - Virtual size: 165KB

.dynsym
Size: 57KB - Virtual size: 56KB

99:76:f7:0f
Certificate

99:76:f2:f4
Certificate

b6:83:62:d4:6c:07:0b:f8:c4:4f:d5:09:53:23:e1:41:49:42:66:3d:9d:29:60:26:15:fd:b9:9d:ba:bf:44:b2
Signer

/4
Size: 94KB - Virtual size: 94KB

.text
Size: 580KB - Virtual size: 580KB

.reloc
Size: 512B - Virtual size: 10B

.data
Size: 169KB - Virtual size: 169KB

.dynamic
Size: 512B - Virtual size: 304B

.rela
Size: 107KB - Virtual size: 107KB

/14
Size: 512B - Virtual size: 24B

.dynsym
Size: 58KB - Virtual size: 58KB

10:04:b1:1d:d9:a9:a3:06:a4:87:5b:73:be:1c:ce:39:91:04:c4:33
Certificate

c0:eb:b5:88:fd:49:c9:d4:7d:c2:2c:09:6f:24:36:1c:05:28:d9:d9:df:0b:34:db:08:1c:59:6b:02:92:8d:e5
Signer

.text
Size: 31KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 10B

.data
Size: 10KB - Virtual size: 10KB

.dynamic
Size: 512B - Virtual size: 256B

.rela
Size: 4KB - Virtual size: 4KB

.dynsym
Size: 1KB - Virtual size: 1KB

10:04:b1:1d:d9:a9:a3:06:a4:87:5b:73:be:1c:ce:39:91:04:c4:33
Certificate

01:6e:e7:87:8d:32:22:42:66:f0:fd:b8:1b:d3:7c:8e:ef:cf:23:cc:26:25:c0:40:49:12:2d:d0:78:be:c1:42
Signer

.text
Size: 88KB - Virtual size: 88KB

.data
Size: 64KB - Virtual size: 64KB

mods
Size: 369KB - Virtual size: 369KB

.reloc
Size: 5KB - Virtual size: 5KB

99:76:f7:0f
Certificate

99:76:f2:f4
Certificate

71:91:04:da:1d:bd:13:d4:81:ae:6c:a4:6a:ec:cb:04:7c:d7:59:59:23:99:14:9a:99:d5:a0:74:b3:ef:0b:e4
Signer

.text
Size: 569KB - Virtual size: 568KB

.reloc
Size: 512B - Virtual size: 10B

.data
Size: 134KB - Virtual size: 133KB

.dynamic
Size: 512B - Virtual size: 152B

.rel
Size: 36KB - Virtual size: 35KB

.rel.plt
Size: 512B - Virtual size: 8B

.dynsym
Size: 39KB - Virtual size: 38KB

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 64B - Virtual size: 36B