53356ecc937e087e3b80a7d5226fe7fb958ae081395b982d9fb2d3305283e4a2

Sharing

Copy URL Twitter E-mail

General

Target

53356ecc937e087e3b80a7d5226fe7fb958ae081395b982d9fb2d3305283e4a2
Size

36KB
MD5

c7be7e90f63dada6cd541fa84880874b
SHA1

9e51a1b4a46a6e8a2ee883b5d3e2d2aa88501bc4
SHA256

53356ecc937e087e3b80a7d5226fe7fb958ae081395b982d9fb2d3305283e4a2
SHA512

3f34340ab0383d7a53e8463fb6fd4187a1b34079bd08ffd642d8455b7917901df82bded079a34c769b87af0cf473debbac5718cc2fa16bfe2db475ec191f081e
SSDEEP

768:T31ySCpoCbXnfDbEaJSooKIDyE9aBazWlEAuIHe:7gyCb3MFKIHO4AuIHe

Score

1^/10

Malware Config

Signatures

Files

53356ecc937e087e3b80a7d5226fe7fb958ae081395b982d9fb2d3305283e4a2
.sys windows:6 windows x64 arch:x64

e233f2cdc91faafe1467d9e52f166213

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/07/2015, 00:00

Not After

26/07/2018, 23:59

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:e9:c0:78:ec:49:c3:c6:1a:b6:68:38:26:9f:aa:18:84:98:aa:f0
Signer

Actual PE Digest

31:e9:c0:78:ec:49:c3:c6:1a:b6:68:38:26:9f:aa:18:84:98:aa:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\projects\rawdisk\bin\wnet\fre\amd64\rawdsk3.pdb

Imports

ntoskrnl.exe

MmSystemRangeStart
ExAllocatePoolWithTag
ExRaiseStatus
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
PsLookupProcessByProcessId
IoBuildSynchronousFsdRequest
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
MmGetSystemRoutineAddress
KeInitializeEvent
RtlUnicodeStringToAnsiString
RtlGetVersion
IoFreeMdl
KeUnstackDetachProcess
IoFileObjectType
MmMapLockedPagesSpecifyCache
IoBuildAsynchronousFsdRequest
RtlPrefixUnicodeString
ZwClose
RtlAppendUnicodeStringToString
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
IoFreeIrp
RtlFreeAnsiString
MmProbeAndLockPages
RtlCompareUnicodeString
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
PsGetCurrentProcessId
ObfDereferenceObject
IoCreateDevice
ZwOpenFile
FsRtlIsNtstatusExpected
ObOpenObjectByPointer
KeStackAttachProcess
IoAllocateMdl
IofCallDriver
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
IoGetAttachedDevice
IoGetRelatedDeviceObject
IoIs32bitProcess
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ZwWaitForSingleObject
ZwDeviceIoControlFile
ObfReferenceObject
ExAcquireRundownProtection
ZwReadFile
ZwMapViewOfSection
ExReleaseRundownProtection
ExEnumHandleTable
ZwCreateFile
ZwUnmapViewOfSection
ObCloseHandle
PsInitialSystemProcess
IoAllocateIrp
RtlCompareMemory
ZwCreateSection
ZwWriteFile
MmUnmapIoSpace
MmMapIoSpace
ExReleaseFastMutex
ExAcquireFastMutex
PsCreateSystemThread
PsGetVersion
KeBugCheckEx
RtlGetElementGenericTable
PsSetLoadImageNotifyRoutine
ZwQuerySymbolicLinkObject
ExpInterlockedPushEntrySList
RtlAppendUnicodeToString
ExpInterlockedPopEntrySList
RtlDeleteElementGenericTable
PsSetCreateProcessNotifyRoutine
ZwOpenSymbolicLinkObject
KeDelayExecutionThread
ExDeletePagedLookasideList
PsTerminateSystemThread
RtlLookupElementGenericTable
ExQueryDepthSList
PsRemoveLoadImageNotifyRoutine
FsRtlDissectName
ExInitializePagedLookasideList
RtlInitializeGenericTable
RtlInsertElementGenericTable
__C_specific_handler

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e233f2cdc91faafe1467d9e52f166213

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

31:e9:c0:78:ec:49:c3:c6:1a:b6:68:38:26:9f:aa:18:84:98:aa:f0Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 648B

PAGE Size: 18KB - Virtual size: 18KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 1020B

.reloc Size: 512B - Virtual size: 36B

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

31:e9:c0:78:ec:49:c3:c6:1a:b6:68:38:26:9f:aa:18:84:98:aa:f0
Signer

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 648B

PAGE
Size: 18KB - Virtual size: 18KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 1020B

.reloc
Size: 512B - Virtual size: 36B