ci[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ci.dll
Size

398KB
MD5

bb55d7cdd67f1a1502b1040a997d4967
SHA1

e12f6b46b6715275541caac63b06947aa04a144f
SHA256

a5c7b4b3a5956fb0cdbbb17a2b064dc65c3e77fe029323cd01a4214c7bec2ded
SHA512

242c711cc9b70ad1d040b5e4ca83722dc7b160c28826321d1a97b62fae19c322efd3c8ef0ac837c1761cc220b09dcd501e82fc3b3cdd042d047621aac5997d20
SSDEEP

6144:5jROOaJcfI3cKxxllJqp6iRPcZKrHrffGW1Yc9gd/d37BUzpR1/6vi5JHg5:5RRax/x7YDUIL2rcI/17BUP1/6vH5

Score

1^/10

Malware Config

Signatures

Files

ci.dll
.dll windows:6 windows x86 arch:x86

8ce401d35f850d9536b8a097a1324812

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:cf:8b:1d:fd:34:13:42:a7:f3:e8:60:10:7d:ab:b0:26:8b:8e:b5:22:ed:21:a4:d5:7b:c1:c4:d1:da:5c:92
Signer

Actual PE Digest

2c:cf:8b:1d:fd:34:13:42:a7:f3:e8:60:10:7d:ab:b0:26:8b:8e:b5:22:ed:21:a4:d5:7b:c1:c4:d1:da:5c:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ci.pdb

Imports

ntoskrnl.exe

ExfAcquirePushLockExclusive
ExfTryToWakePushLock
RtlCopyUnicodeString
ExAllocatePoolWithTag
KdDebuggerNotPresent
KdDebuggerEnabled
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ExQueueWorkItem
ExFreePoolWithTag
KeSetCoalescableTimer
KeInitializeDpc
KeInitializeTimer
ZwOpenFile
KeBugCheckEx
KeTickCount
PsGetCurrentProcessId
EtwUnregister
InitSafeBootMode
EtwRegister
_allmul
PsGetCurrentProcess
KeExpandKernelStackAndCalloutEx
ZwQueryInformationFile
ObOpenObjectByPointer
IoFileObjectType
ObQueryNameString
memcpy
PsIsProtectedProcess
memset
memmove
ExAllocatePoolWithQuotaTag
EtwEventEnabled
DbgPrint
bsearch
KeUnstackDetachProcess
RtlFreeUnicodeString
KeStackAttachProcess
FsRtlGetFileSize
PsIsCurrentThreadPrefetching
ZwReadFile
EtwWrite
SeReportSecurityEventWithSubCategory
MmUnlockPages
KeWaitForSingleObject
IoPageRead
KeInitializeEvent
MmProbeAndLockPages
MmSizeOfMdl
ZwSetInformationThread
ZwQueryInformationThread
RtlUnwind
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
RtlCompareMemory
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
ExAcquireResourceSharedLite
ExInitializeResourceLite
ExDeleteResourceLite
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
ZwWriteFile
ZwCreateFile
RtlAppendUnicodeStringToString
RtlDecompressBuffer
ExConvertExclusiveToSharedLite
ExIsResourceAcquiredExclusiveLite
RtlEqualUnicodeString
ZwQueryDirectoryFile
RtlCreateUnicodeString
atol
RtlTimeFieldsToTime
isdigit
_alldiv
atoi
_aulldiv
PsCreateSystemThread
RtlCompareUnicodeString
RtlAppendUnicodeToString
wcschr
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
PsSetCreateProcessNotifyRoutine
IoGetCurrentProcess
PsInitialSystemProcess
PsTerminateSystemThread
RtlRunOnceExecuteOnce
KeSetPriorityThread
KeGetCurrentThread
NtSetInformationThread
NtQueryInformationThread
wcsncmp
ExAllocatePool
_allshl
_alloca_probe

Exports

Exports

CiCheckSignedFile
CiFindPageHashesInCatalog
CiFindPageHashesInSignedFile
CiFreePolicyInfo
CiGetPEInformation
CiInitialize
CiVerifyHashInCatalog
_RtlImageNtHeader@4
_RtlImageNtHeaderEx@20

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGECONS
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGECONS
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ce401d35f850d9536b8a097a1324812

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

2c:cf:8b:1d:fd:34:13:42:a7:f3:e8:60:10:7d:ab:b0:26:8b:8e:b5:22:ed:21:a4:d5:7b:c1:c4:d1:da:5c:92Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 2KB

PAGE Size: 312KB - Virtual size: 312KB

.edata Size: 512B - Virtual size: 324B

PAGECONS Size: 8KB - Virtual size: 8KB

PAGEDATA Size: 3KB - Virtual size: 2KB

PAGECONS Size: 24KB - Virtual size: 23KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 9KB - Virtual size: 8KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

2c:cf:8b:1d:fd:34:13:42:a7:f3:e8:60:10:7d:ab:b0:26:8b:8e:b5:22:ed:21:a4:d5:7b:c1:c4:d1:da:5c:92
Signer

.text
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 2KB

PAGE
Size: 312KB - Virtual size: 312KB

.edata
Size: 512B - Virtual size: 324B

PAGECONS
Size: 8KB - Virtual size: 8KB

PAGEDATA
Size: 3KB - Virtual size: 2KB

PAGECONS
Size: 24KB - Virtual size: 23KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 9KB - Virtual size: 8KB