F[.]U[.]N[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

F.U.N.zip
Size

30.4MB
MD5

03051f7057560da1e147abdbe0f8e3ca
SHA1

790f14926cb4e1232ff0d55db712559b8abba396
SHA256

99ea039bad1d7ba8425465e91d27db0df2baee7b7ebc42bbaf9b9ac7b082c86e
SHA512

ca61bf177f7f71d005b09b5bae1f737cc82d09c56dbfea24b0fdea6bb9ccc39ee22941c3b341378788c8b567bbd67901352429bf42b49277077b1a308a18b5df
SSDEEP

786432:pc/2SUhPl1NdsQzhuCuDcGb+OJJ8uAUNg+Usl8OibDK:pE2P5dsQzhvOJybcP8Oom

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/F.U.N/Ionic.Zip.Reduced.dll
unpack001/F.U.N/Microsoft.Win32.TaskScheduler.dll
unpack001/F.U.N/log4net.dll
unpack001/F.U.N/websocket-sharp.dll

Files

F.U.N.zip
.zip
F.U.N/EIO.dll
.dll windows:5 windows x64 arch:x64

fb92eefda0b12adc7224e8c2bfcd8c92

Code Sign

0c:51:67:c0:23:b9:ad:ed:f0:f8:91:8e:e6:57:12:a1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2019, 00:00

Not After

23/03/2022, 12:00

Subject

SERIALNUMBER=23638777,CN=ASUSTEK COMPUTER INC.,O=ASUSTEK COMPUTER INC.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:ff:b0:94:ee:99:71:b3:85:0a:18:7d:f4:01:26:e8:bf:73:58:74:32:33:97:a0:fc:5a:61:b4:ae:dd:b4:dd
Signer

Actual PE Digest

29:ff:b0:94:ee:99:71:b3:85:0a:18:7d:f4:01:26:e8:bf:73:58:74:32:33:97:a0:fc:5a:61:b4:ae:dd:b4:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

Sleep
CopyFileA
SetFileAttributesA
GetWindowsDirectoryA
DeleteFileA
LocalFree
FormatMessageA
MoveFileA
GetSystemDirectoryA
OpenMutexA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleHandleW
CreateFileW
SetStdHandle
WriteConsoleW
DeviceIoControl
GetModuleHandleA
GetProcAddress
GetVersion
CreateMutexA
GetModuleFileNameA
GetCurrentProcess
WaitForSingleObject
ReleaseMutex
CreateFileA
GetLastError
CloseHandle
GetModuleHandleExW
UnhandledExceptionFilter
ExitProcess
DecodePointer
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
FlsGetValue
FlsFree
SetLastError
FlsAlloc
WriteFile
GetStdHandle
GetModuleFileNameW
HeapFree
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer

user32

ExitWindowsEx
wsprintfA

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
ControlService
DeleteService
QueryServiceStatus
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
OpenSCManagerA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
OpenProcessToken

Exports

Exports

BusTypeAndDataRate
DefineBaseAddr9X
DefinePort
DetectI2CDevice
EIOInit
FindVGAChip
FindVGAChipEX
GetATIClock
GetBIOSMapBaseAddress
GetBYTEVGABIOSData
GetBYTEVGAMMIOData
GetDWORDVGABIOSData
GetDWORDVGAMMIOData
GetMapAddress
GetMapAddress_2
GetPcicfgAddr
GetROMMapAddress
GetVGABIOSAddress
GetVGAMMIOAddress
GetWORDVGABIOSData
GetWORDVGAMMIOData
InitDevice
IsAGP30
IsASUSVGACard
IsPCIE
PortDefine_DetectI2C
ReadBIOSMMIOByte
ReadBIOSMMIODword
ReadBIOSMMIOWord
ReadI2C
ReadI2CByte
ReadMMIOByte
ReadMMIODword
ReadMMIOWord
Read_2_MMIOByte
Read_2_MMIODword
Read_2_MMIOWord
SetATIClock
SetPcicfgData
SmartDocExist
WriteBIOSMMIOByte
WriteBIOSMMIODword
WriteBIOSMMIOWord
WriteBYTEVGAMMIOData
WriteDWORDVGAMMIOData
WriteI2C
WriteI2CByte
WriteMMIOByte
WriteMMIODword
WriteMMIOWord
WriteRegistrySZ
WriteWORDVGAMMIOData
Write_2_MMIOByte
Write_2_MMIODword
Write_2_MMIOWord

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
F.U.N/IOMap64.sys
.sys windows:6 windows x64 arch:x64

4463e084dfd14f74158c0725d8f13b78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:a3:cf:fb:19:4d:c5:f8:7d:69:51:da:6d:0c:3a:01
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/09/2015, 00:00

Not After

01/08/2018, 12:00

Subject

CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,ST=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/02/2017, 20:47

Not After

09/05/2018, 20:47

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:7d:22:43:40:1d:b1:c4:ef:7e:28:09:3a:17:de:d9:71:d5:c0:04:0b:6e:5f:d9:85:80:38:15:95:7f:67:db
Signer

Actual PE Digest

5f:7d:22:43:40:1d:b1:c4:ef:7e:28:09:3a:17:de:d9:71:d5:c0:04:0b:6e:5f:d9:85:80:38:15:95:7f:67:db

Digest Algorithm

sha256

PE Digest Matches

true

0e:ef:2f:02:3f:2f:68:8b:26:40:58:ea:ac:7a:85:0e:d7:bb:18:22
Signer

Actual PE Digest

0e:ef:2f:02:3f:2f:68:8b:26:40:58:ea:ac:7a:85:0e:d7:bb:18:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\iomap-v1.5_20170428\objfre_win7_amd64\amd64\IOMap.pdb

Imports

ntoskrnl.exe

KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
MmUnmapIoSpace
MmMapIoSpace
PoStartNextPowerIrp
IofCompleteRequest
ExFreePoolWithTag
IoCreateSymbolicLink
IoCreateDevice
KeReleaseMutex
KeWaitForSingleObject
KeBugCheckEx
IoDeleteSymbolicLink
PoCallDriver
ExAllocatePoolWithTag

hal

HalTranslateBusAddress
KeStallExecutionProcessor

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
F.U.N/Ionic.Zip.Reduced.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip Reduced\obj\Release\Ionic.Zip.Reduced.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
F.U.N/Microsoft.Win32.TaskScheduler.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
F.U.N/NiceHashQuickMiner.exe
.exe windows:4 windows x64 arch:x64

Code Sign

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:7e:7c:7e:84:00:60:5f:1a:cd:31:7a:2c:cb:9b:ea
Certificate

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/04/2024, 00:00

Not After

10/07/2024, 23:59

Subject

SERIALNUMBER=6633994000,CN=H-Bit\, d.o.o.,O=H-Bit\, d.o.o.,L=Maribor,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:7e:7c:7e:84:00:60:5f:1a:cd:31:7a:2c:cb:9b:ea
Certificate

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/04/2024, 00:00

Not After

10/07/2024, 23:59

Subject

SERIALNUMBER=6633994000,CN=H-Bit\, d.o.o.,O=H-Bit\, d.o.o.,L=Maribor,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:df:19:57:36:01:e3:17:92:52:12:a9:ef:c8:2f:16:0b:ad:41:6f:62:7b:b4:ba:22:f9:9c:8f:d3:97:5e:a5
Signer

Actual PE Digest

5a:df:19:57:36:01:e3:17:92:52:12:a9:ef:c8:2f:16:0b:ad:41:6f:62:7b:b4:ba:22:f9:9c:8f:d3:97:5e:a5

Digest Algorithm

sha256

PE Digest Matches

true

74:7d:bc:a7:57:97:68:c7:01:40:a6:1e:d6:cc:6d:80:6b:9a:39:81
Signer

Actual PE Digest

74:7d:bc:a7:57:97:68:c7:01:40:a6:1e:d6:cc:6d:80:6b:9a:39:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Z:\Development\signing\excavator\watchdog2\obj\Release\NiceHashQuickMiner.pdb

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
F.U.N/README.txt
F.U.N/Uninstall.lnk
.lnk
F.U.N/WinRing0x64.sys
.sys windows:6 windows x64 arch:x64

d41fa95d4642dc981f10de36f4dc8cd7

Code Sign

01:00:00:00:00:01:15:37:24:21:a8
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2007, 10:50

Not After

24/09/2008, 10:50

Subject

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

04:00:00:00:00:00:f9:7f:aa:2e:1e
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/12/2003, 13:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:10:92:eb:82:95
Certificate

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Not Before

05/02/2007, 09:00

Not After

27/01/2014, 09:00

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:00

Not After

23/05/2016, 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da
Signer

Actual PE Digest

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateDevice
MmMapIoSpace
KeBugCheckEx
IoCreateSymbolicLink
MmUnmapIoSpace
IofCompleteRequest
__C_specific_handler

hal

HalSetBusDataByOffset
HalGetBusDataByOffset

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
F.U.N/changelog.txt
F.U.N/commands.json
F.U.N/excavator.exe
.exe windows:6 windows x64 arch:x64

dc4033d6812e3cfbf13bf75eb8597cf2

Code Sign

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:7e:7c:7e:84:00:60:5f:1a:cd:31:7a:2c:cb:9b:ea
Certificate

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/04/2024, 00:00

Not After

10/07/2024, 23:59

Subject

SERIALNUMBER=6633994000,CN=H-Bit\, d.o.o.,O=H-Bit\, d.o.o.,L=Maribor,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:7e:7c:7e:84:00:60:5f:1a:cd:31:7a:2c:cb:9b:ea
Certificate

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/04/2024, 00:00

Not After

10/07/2024, 23:59

Subject

SERIALNUMBER=6633994000,CN=H-Bit\, d.o.o.,O=H-Bit\, d.o.o.,L=Maribor,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:b5:7c:24:93:ef:15:5d:d1:a4:4a:b3:a2:61:54:d7:19:68:9f:a8:7b:6f:53:96:55:eb:4e:03:e8:63:0d:eb
Signer

Actual PE Digest

39:b5:7c:24:93:ef:15:5d:d1:a4:4a:b3:a2:61:54:d7:19:68:9f:a8:7b:6f:53:96:55:eb:4e:03:e8:63:0d:eb

Digest Algorithm

sha256

PE Digest Matches

true

f6:6d:84:8b:9f:ab:17:b6:5d:a2:25:57:ec:98:76:18:70:8c:24:18
Signer

Actual PE Digest

f6:6d:84:8b:9f:ab:17:b6:5d:a2:25:57:ec:98:76:18:70:8c:24:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

pdh

PdhAddEnglishCounterA

opencl

clSetKernelArg

crypt32

CertOpenStore

cabinet

ord40

winmm

timeEndPeriod

ws2_32

accept

kernel32

GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetUserObjectInformationW
CharUpperBuffW

advapi32

LookupPrivilegeValueA

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

mswsock

GetAcceptExSockaddrs

Exports

Exports

1��k��$f�{ʂ�`8�..,�t�2� �P�1��"� w/S��x�]�,�Ϻ��-��K<=�n�5(��M��8��(:��~�T��l;9��Ŷ.F�� X��a]+8�M�4�;��e�;(��[ֲ��w�4��՛Ԥ��y f��EW*��{=M�۝p�i��z��0��F ^c�|�̀��_� &�� `��*�W�L��Ta,Y>I�M��>!�J�mLo�@��f��(H9-�7�^(%�)�)�)X{}}`��&�%��=S��(�䙏�SO��s<uL{Oy]�R=�(dD�?��.� ��@n��]=��o�.#v�U�^�胬-EDq�-c�:_��ձ(�V��0x r��W� ��r�7:��0'9{��o ${K��>��ǌө]��b�C�av��~ wC{��5��#Tx�.=Ǖ��ʊ>V-[�^�̟D)�� x}`�MJb#�g��i��W�#�mE�Y��&��zp��a}g`g��w�h��b�=:�[�v� 1�g�G#��x�V��i*鼉��=��b�T��gD�<��1z�,��S6�/[;x��4��B��@ d!0��li��\5 ��/;�D�[wG�pNs� ��(�LZ��(o��(�j࿦��Ёu�e'��Q��:��l� P�d��s��]��J��ިo�V�!��;��Y�jL�*�b1K��G��,�b��S�p��?�/`��MW��/ۍc��r4>W��χ�Z��O��8��-DN�4~�N}�l��3�� J��`k��?W�&rP5o��e1� �=��ǒ7�*r�p��ր~O|bQ�첢na��=9�o��dAk�=y��d��et_1��G��U��+m[��rC��D��WG��6Jm��~SӧoO��,�o+>^�tS~GgB��1́�=��C侔TI�a��M�<�\hހ?�l�3 2{3�?%�kǯ.��s��j�`��O�(��KFF��_υU�3xi��Z`��>^�Ŵ'zs��qN�� Y̎��d��m�'��G��Tk|��W��{X�|�[TFE�ӳ��x�xʣ��l�$8_�F�[��"��r}�(��Gp��&��k�@��A:qΞ��F��O`�:mpa��i^�t�S3�t}��UH!�Od��>�W��.S\rsױ�Qu��t��l��be��_sנ�T��-�a��W��bj�W��]0�O��H�6��kA�\<9�� #H��d�lM�Z��ymC�JJWzQU�ſM�@�W��h��r)��=�d`,��7΁U��b�h��,C�IEb��<P�v z�i��9��.̻��O/]��\l��.��vdL�2�Z� ��H��`�PF��;��m��0TF��_�P�# 94E�Y婬��;z��In�QÎ�o��t��B�e�9l l�I"�Kp-ك1��:ķ��誡�� "��7�V�Q$�lZ��Zk3޻��)i��(ܷz8��*n��C�9.T(��Qr�U��nP7��t}d�`YC˃��)0�1��1��w��LgS�Bڈ� u�Vb�wz�6��&��zi+c�|��å��X�>Xo�_p��G�� C7�وwN�@G�Jǻ�y�m g/��F_Ȳg�&�^)��Cz@��[��t��9� ü�u��q��1�T��t�w�|��Ғdڙ��-Ğ+�(vK|2V��Q�z�/��Y��׀��-]]��=ڲG��B� �\F��dm_~�:?��70��"őjJ@fQV��͇��V��XF�RU,��%�m�$T�:�頓O�B|o%��_�YN �x�H@`��OY��¹/z�+Xi?^�NN��>��S��R��0��gZ��L�rA,��-uL��,lB� |��Yd�BT��-S��2q�jg��<�uaA�}��/��#|��ldI��Gqć��*N��-K'��K�]&��@�rM��5�ԐY�E��*��%��B��à�=KL̚��L9��Ş�\�.D��א�6͆�2c�Ę�XWt��%സ�ƽ^�]��Ǐ�p��B�$��W��}(��&k�.��B{]A�7��C%4�� ^��Jv�Ph�C��u)642\��:��!6�~.��J{��'�MuC"�9(��d<Y/��؈�l)�ʑ��rGd*��L\�)��)[�74�t?��I��Y@g�ZD��1�x�M��eF�-��mE�W�̯R��p��{IN��%2J��6E��!��i�e�Zء��zc�S��ޠ}�$`��̗��XG0�W��r�I��i�3��=VNs��**��Ţņ��<�Ri��Q��F��k@=��K_��ƽuk-��6]o2�C2��1O�[N��p�a�\Vn-� ��8�(AO�LZ��]�ٗ�];/�fp�� ph8�!�� M�s�^�|��>'��|=��B�p��.=�r��x�˕�ګ�i��fme�>�/��O~BG=%L8�0+�U.��c��Ä1�gB��r�D��e r�s�7�﫬�3eL�� <"_��b8�Ke.qj�5��+�Gx�iZ�&��!oqmؘ��]��\C��h΋CQ_J<=3�rS��~��h�GZ��G�� a:��)wd?;e�*3�u��"�0Y!&��)�� U��(.�x�4��bp��_�E��D0n-@��_�+v�0[d�_��#��[>�}ǿ�Z��M�ǵ��o�� ?�¤3U�4C�F"�@��/��+�v5ݔk�W!�� 9x-]I7/��\��>�O��G��r.�IȴGz��4
??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z
??1?$codecvt_null@_W@archive@boost@@UEAA@XZ
??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?unlock@singleton_module@serialization@boost@@QEAAXXZ
NvOptimusEnablementCuda

Sections

.text
Size: - Virtual size: 44.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 14.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 34.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nv_fatb
Size: - Virtual size: 10.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nvFatBi
Size: - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RANDOMX
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.,!3
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.z"d
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DZ1
Size: 29.3MB - Virtual size: 29.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
F.U.N/licenses/LICENSE_ADL.txt
F.U.N/licenses/LICENSE_BOOST.txt
F.U.N/licenses/LICENSE_MBEVAND.txt
F.U.N/licenses/LICENSE_OPENSSL.txt
F.U.N/licenses/LICENSE_PASCAL.txt
F.U.N/licenses/LICENSE_TROMP.txt
F.U.N/licenses/LICENSE_XENONCAT.txt
F.U.N/licenses/LICENSE_log4net.txt
F.U.N/licenses/LICENSE_managedcuda.txt
F.U.N/licenses/LICENSE_websockets.txt
F.U.N/licenses/LICENSE_winring0x64.txt
F.U.N/licenses/LICENSE_xmrig.txt
F.U.N/licenses/excavator-EULA.txt
F.U.N/licenses/excavator-notice.txt
F.U.N/licenses/license_DotNetZip.json
F.U.N/licenses/license_taskscheduler.txt
F.U.N/licenses/quickminer-eula.rtf
.rtf
F.U.N/licenses/quickminer-notice.rtf
.rtf
F.U.N/log4net.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 252KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
F.U.N/nhqm.conf
F.U.N/octune/assets/arrow-down.f1ac8296.svg
F.U.N/octune/assets/arrow-left.902abb24.svg
F.U.N/octune/assets/dropdown.d9ec4588.svg
F.U.N/octune/assets/efficiency-white.6e1b1dff.svg
F.U.N/octune/assets/fan-orange.56b4c25f.svg
F.U.N/octune/assets/gear-orange.c93f1db6.svg
F.U.N/octune/assets/gpu-temp-white.7257d0f4.svg
F.U.N/octune/assets/gpu-white.852a020d.svg
F.U.N/octune/assets/index.302dc3bf.js
.js
F.U.N/octune/assets/index.7fd0d3fa.css
F.U.N/octune/assets/logo-text-dark.f0b8647c.svg
F.U.N/octune/assets/minimize-in.f24aa904.svg
F.U.N/octune/assets/overclocking-orange.6051e921.svg
F.U.N/octune/assets/power-white.7cbf3d38.svg
F.U.N/octune/assets/settings.870659f6.svg
F.U.N/octune/assets/speed-white.f1d029f2.svg
F.U.N/octune/assets/ubuntu-300.273b9d2d.svg
.xml
F.U.N/octune/assets/ubuntu-300.5d02319e.eot
F.U.N/octune/assets/ubuntu-300.ac69cf4b.woff2
F.U.N/octune/assets/ubuntu-300.caaf824b.ttf
F.U.N/octune/assets/ubuntu-300.e501fa68.woff
F.U.N/octune/assets/ubuntu-300italic.21782777.ttf
F.U.N/octune/assets/ubuntu-300italic.22912346.woff2
F.U.N/octune/assets/ubuntu-300italic.23ed8e5c.eot
F.U.N/octune/assets/ubuntu-300italic.3a6ca87b.woff
F.U.N/octune/assets/ubuntu-300italic.a4c9a28e.svg
.xml
F.U.N/octune/assets/ubuntu-700.47cbb140.svg
.xml
F.U.N/octune/assets/ubuntu-700.4a6994f0.eot
F.U.N/octune/assets/ubuntu-700.692782cf.woff
F.U.N/octune/assets/ubuntu-700.83bf027c.ttf
F.U.N/octune/assets/ubuntu-700.ed421611.woff2
F.U.N/octune/assets/ubuntu-regular.41e3b7f7.ttf
F.U.N/octune/assets/ubuntu-regular.66ade46c.svg
.xml
F.U.N/octune/assets/ubuntu-regular.88beb13c.woff2
F.U.N/octune/assets/ubuntu-regular.8b5f2727.eot
F.U.N/octune/assets/ubuntu-regular.d6337732.woff
F.U.N/octune/assets/vram-temp-white.20a26ef2.svg
F.U.N/octune/assets/wizard-orange.a011bd0c.svg
F.U.N/octune/data.json
F.U.N/octune/favicon.ico
F.U.N/octune/index.html
.html
F.U.N/websocket-sharp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 247KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb92eefda0b12adc7224e8c2bfcd8c92

Code Sign

0c:51:67:c0:23:b9:ad:ed:f0:f8:91:8e:e6:57:12:a1Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

29:ff:b0:94:ee:99:71:b3:85:0a:18:7d:f4:01:26:e8:bf:73:58:74:32:33:97:a0:fc:5a:61:b4:ae:dd:b4:ddSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 7KB - Virtual size: 15KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 1024B - Virtual size: 850B

4463e084dfd14f74158c0725d8f13b78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:a3:cf:fb:19:4d:c5:f8:7d:69:51:da:6d:0c:3a:01Certificate

Extended Key Usages

Key Usages

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

5f:7d:22:43:40:1d:b1:c4:ef:7e:28:09:3a:17:de:d9:71:d5:c0:04:0b:6e:5f:d9:85:80:38:15:95:7f:67:dbSigner

0e:ef:2f:02:3f:2f:68:8b:26:40:58:ea:ac:7a:85:0e:d7:bb:18:22Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 1024B - Virtual size: 612B

.data Size: 512B - Virtual size: 872B

.pdata Size: 512B - Virtual size: 360B

INIT Size: 1024B - Virtual size: 752B

.rsrc Size: 1KB - Virtual size: 1KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

0c:51:67:c0:23:b9:ad:ed:f0:f8:91:8e:e6:57:12:a1
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

29:ff:b0:94:ee:99:71:b3:85:0a:18:7d:f4:01:26:e8:bf:73:58:74:32:33:97:a0:fc:5a:61:b4:ae:dd:b4:dd
Signer

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 7KB - Virtual size: 15KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 1024B - Virtual size: 850B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:a3:cf:fb:19:4d:c5:f8:7d:69:51:da:6d:0c:3a:01
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

5f:7d:22:43:40:1d:b1:c4:ef:7e:28:09:3a:17:de:d9:71:d5:c0:04:0b:6e:5f:d9:85:80:38:15:95:7f:67:db
Signer

0e:ef:2f:02:3f:2f:68:8b:26:40:58:ea:ac:7a:85:0e:d7:bb:18:22
Signer

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 1024B - Virtual size: 612B

.data
Size: 512B - Virtual size: 872B

.pdata
Size: 512B - Virtual size: 360B

INIT
Size: 1024B - Virtual size: 752B

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 245KB - Virtual size: 244KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 311KB - Virtual size: 311KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

05:7e:7c:7e:84:00:60:5f:1a:cd:31:7a:2c:cb:9b:ea
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

05:7e:7c:7e:84:00:60:5f:1a:cd:31:7a:2c:cb:9b:ea
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5a:df:19:57:36:01:e3:17:92:52:12:a9:ef:c8:2f:16:0b:ad:41:6f:62:7b:b4:ba:22:f9:9c:8f:d3:97:5e:a5
Signer

74:7d:bc:a7:57:97:68:c7:01:40:a6:1e:d6:cc:6d:80:6b:9a:39:81
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 283KB - Virtual size: 283KB

01:00:00:00:00:01:15:37:24:21:a8
Certificate

04:00:00:00:00:00:f9:7f:aa:2e:1e
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:10:92:eb:82:95
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da
Signer