313cc03a406709af7854749a49532002f12e12bfabccda6f9a21281041626e5c

Sharing

Copy URL Twitter E-mail

General

Target

313cc03a406709af7854749a49532002f12e12bfabccda6f9a21281041626e5c
Size

20KB
MD5

78e4d721805ef4e87d7bac8dee42005f
SHA1

954a778d2f5a0df32fa836eeaea84a230675700f
SHA256

313cc03a406709af7854749a49532002f12e12bfabccda6f9a21281041626e5c
SHA512

18c73198718a49d6d5de97b1478787739eb25f24398187d9962bac85a67fb9986f940deaf5645a269f1a8ef226e2bfbdeba29dcb7d5eb2cbf4a2cc5777b3ff83
SSDEEP

384:j63rQkgTE2/Fg/pE1kaIKpwRkuBYeCYxl:jtkgTEOFiXVgok0jl

Score

1^/10

Malware Config

Signatures

Files

313cc03a406709af7854749a49532002f12e12bfabccda6f9a21281041626e5c
.sys windows:6 windows x86 arch:x86

e31f8091146f12498accfd15a8903786

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:d4:8f:27:ab:e1:75:74:47:3e:40:66:a8:63:79:2d:46
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

16/10/2012, 17:12

Not After

17/10/2015, 17:12

Subject

CN=Hilscher Gesellschaft fuer Systemautomation mbH,OU=Entwicklung,O=Hilscher Gesellschaft fuer Systemautomation mbH,L=Hattersheim,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:59:6c:b3:24:f4:d1:60:8b:3b:84:6c:08:39:13:45:21:d3:43:58
Signer

Actual PE Digest

73:59:6c:b3:24:f4:d1:60:8b:3b:84:6c:08:39:13:45:21:d3:43:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projekte\devicedriver\physicalmemoryviewer\wforms\v1.0.0.0\driver\objfre_win7_x86\i386\physmem.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
ExAllocatePoolWithQuotaTag
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpace
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
memcpy
IoCreateSymbolicLink
KeTickCount
MmGetSystemRoutineAddress
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
ExAllocatePoolWithTag
RtlLengthSid
memset
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e31f8091146f12498accfd15a8903786

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

11:21:d4:8f:27:ab:e1:75:74:47:3e:40:66:a8:63:79:2d:46Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

73:59:6c:b3:24:f4:d1:60:8b:3b:84:6c:08:39:13:45:21:d3:43:58Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 950B

.data Size: 512B - Virtual size: 408B

PAGE Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 428B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

11:21:d4:8f:27:ab:e1:75:74:47:3e:40:66:a8:63:79:2d:46
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

73:59:6c:b3:24:f4:d1:60:8b:3b:84:6c:08:39:13:45:21:d3:43:58
Signer

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 950B

.data
Size: 512B - Virtual size: 408B

PAGE
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 428B