4f6b732dfa5b4d91c56235f7c69974a4c557d6348f4ed9b862fa4938f7ce3848

Sharing

Copy URL Twitter E-mail

General

Target

4f6b732dfa5b4d91c56235f7c69974a4c557d6348f4ed9b862fa4938f7ce3848
Size

34KB
MD5

761e49319f58717041cd00794b500ee9
SHA1

38d0e92aff991cfc9c68d7baad6cb85916139af5
SHA256

4f6b732dfa5b4d91c56235f7c69974a4c557d6348f4ed9b862fa4938f7ce3848
SHA512

3b34b944b29c4ab4553e715bad1ba1457c205fb7c480543b41ecdef7932171e326065b30709a641a3717fd83569444389922c4bf50c7e61385eb0f21419db5b5
SSDEEP

768:BTFqfOFvJvdbgLeS7b7bZQvCIz4dTk7+QvQpL2+tT0CSl:BTwohNCbXH2VqtoP

Score

1^/10

Malware Config

Signatures

Files

4f6b732dfa5b4d91c56235f7c69974a4c557d6348f4ed9b862fa4938f7ce3848
.sys windows:5 windows x86 arch:x86

150ebc9e04c8dc51e4247a5115ccc8b4

Code Sign

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0f:8b:60:0f:f1:88:2e
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

29/03/2012, 09:07

Not After

02/04/2014, 06:24

Subject

CN=Hangzhou Leishite Laser Technology Co.\, Ltd.,O=Hangzhou Leishite Laser Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,1.2.840.113549.1.9.1=#0c0f6c737474656368403136332e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

61:39:bb:9c:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:13

Not After

15/04/2021, 20:23

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:6e:e0:45:6c:a9:54:e1:53:e1:69:c5:02:e5:44:f5:4c:da:0c:33
Signer

Actual PE Digest

90:6e:e0:45:6c:a9:54:e1:53:e1:69:c5:02:e5:44:f5:4c:da:0c:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\FlowCloud\trunk\Dev\src\fcClient\kmspy\Driver\Release\Driver.pdb

Imports

ntoskrnl.exe

PsCreateSystemThread
PsTerminateSystemThread
_vsnwprintf
ZwClose
RtlInitUnicodeString
RtlCompareUnicodeString
wcsncat
ZwSetInformationFile
ZwCreateFile
ExAllocatePool
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
ZwQueryInformationFile
ZwWriteFile
IoBuildDeviceIoControlRequest
memmove
RtlAnsiStringToUnicodeString
ExInitializeNPagedLookasideList
ExfInterlockedInsertTailList
KeInitializeEvent
RtlInitAnsiString
ExfInterlockedRemoveHeadList
InterlockedPopEntrySList
RtlFreeUnicodeString
IoDriverObjectType
IoGetDeviceObjectPointer
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
DbgPrint
IofCallDriver
InterlockedPushEntrySList
ExAllocatePoolWithTag
RtlCheckRegistryKey
KeDelayExecutionThread
ZwQueryValueKey
IoGetCurrentProcess
ZwOpenKey
KeUnstackDetachProcess
KeStackAttachProcess
_stricmp
ZwQuerySystemInformation
IoDeleteSymbolicLink
IoGetRelatedDeviceObject
IoDeleteDevice
KeSetEvent
IoCreateFile
IoFileObjectType
KeGetCurrentThread
IofCompleteRequest
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
IoIsWdmVersionAvailable
IoCreateSymbolicLink
IoCreateDevice
MmUnmapIoSpace
MmGetPhysicalAddress
MmMapIoSpace
ZwDeleteValueKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
IoDetachDevice
PoStartNextPowerIrp
PsGetCurrentProcessId
MmGetSystemRoutineAddress
PsGetVersion
ExFreePoolWithTag
memset
_except_handler3
_allrem
_alldiv
memcpy

hal

KeGetCurrentIrql

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

150ebc9e04c8dc51e4247a5115ccc8b4

Code Sign

19:9d:f8:8eCertificate

Key Usages

0f:8b:60:0f:f1:88:2eCertificate

Extended Key Usages

Key Usages

61:39:bb:9c:00:00:00:00:00:33Certificate

Key Usages

3dCertificate

Key Usages

90:6e:e0:45:6c:a9:54:e1:53:e1:69:c5:02:e5:44:f5:4c:da:0c:33Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 11KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

19:9d:f8:8e
Certificate

0f:8b:60:0f:f1:88:2e
Certificate

61:39:bb:9c:00:00:00:00:00:33
Certificate

3d
Certificate

90:6e:e0:45:6c:a9:54:e1:53:e1:69:c5:02:e5:44:f5:4c:da:0c:33
Signer

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 11KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB