NetFltInstaller[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NetFltInstaller.exe
Size

70KB
MD5

8a3f61229f85b408bb6981ad1fa0f042
SHA1

6df63dffc8188bad4f3a108f3985e542eb72d678
SHA256

1d24e7af6743087740278524d3202991182367e2f2e6d9f8349ad07ebad13d1a
SHA512

c015313602fba5fca1cbba028b4d089b66f62fd16810461edb9e37c77a9f39f98a8982fe26681081df8d40c07e77a17f11a3794b1a4a0d8055d7a9166ecdee83
SSDEEP

1536:hvNuashRdom+7bt3zSrrOZxsEbt1gPBLEH+DOpzbmLMA5Ny9dy:hFgbWJQiZxtSJLFDubmLMA5Nyy

Score

1^/10

Malware Config

Signatures

Files

NetFltInstaller.exe
.exe windows:5 windows x64 arch:x64

2135b0e71d1b1fdffe58b2cf9124b6be

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:38:b6:6e:e2:8a:db:fd:9d:ee:cd:7e:f9:fb:a8:20:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

13/12/2013, 09:09

Not After

14/12/2014, 09:09

Subject

CN=网神信息技术（北京）股份有限公司,OU=网神信息技术（北京）股份有限公司,O=网神信息技术（北京）股份有限公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6f:56:78:60:57:d6:3e:2c:40:30:8a:80:e2:e7:5b:4b:ba:b3:9a:ef
Signer

Actual PE Digest

6f:56:78:60:57:d6:3e:2c:40:30:8a:80:e2:e7:5b:4b:ba:b3:9a:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Users\zzz\Desktop\Installer\x64\Release\ProtInstall.pdb

Imports

setupapi

SetupCopyOEMInfW

kernel32

FreeEnvironmentStringsW
GetLastError
LocalFree
FormatMessageW
GetModuleFileNameW
GetConsoleWindow
SetConsoleTitleW
CreateFileA
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
MultiByteToWideChar
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
FlushFileBuffers
SetStdHandle
WriteConsoleA

user32

MessageBoxW
ShowWindow

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2135b0e71d1b1fdffe58b2cf9124b6be

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

11:21:38:b6:6e:e2:8a:db:fd:9d:ee:cd:7e:f9:fb:a8:20:4aCertificate

Extended Key Usages

Key Usages

6f:56:78:60:57:d6:3e:2c:40:30:8a:80:e2:e7:5b:4b:ba:b3:9a:efSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

user32

ole32

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

11:21:38:b6:6e:e2:8a:db:fd:9d:ee:cd:7e:f9:fb:a8:20:4a
Certificate

6f:56:78:60:57:d6:3e:2c:40:30:8a:80:e2:e7:5b:4b:ba:b3:9a:ef
Signer

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB