7f54b99ae9a9a4ba862094b0313c6797bf83fe8a43eb23c68fed33ebce8f33b5

Sharing

Copy URL Twitter E-mail

General

Target

7f54b99ae9a9a4ba862094b0313c6797bf83fe8a43eb23c68fed33ebce8f33b5
Size

139KB
MD5

7e120f6b092f1258821312a1d14d79c1
SHA1

983fc485497ed41d47f5efc6ac44b320351eb8ff
SHA256

7f54b99ae9a9a4ba862094b0313c6797bf83fe8a43eb23c68fed33ebce8f33b5
SHA512

eafaab0ead4bfe2c684c1c9de56bb8206d4f913e79d3d71060659584a08f10f572e642618fba3554389d5741d174ee1f5f74f0880b5a9ece65e316524c6fce14
SSDEEP

3072:xHKwx8jfu0GQWcrGIJ0gDCrn3oNEs17TIzhS6yVN:xT8jfAq8D3oNESkzP

Score

1^/10

Malware Config

Signatures

Files

7f54b99ae9a9a4ba862094b0313c6797bf83fe8a43eb23c68fed33ebce8f33b5
.sys windows:4 windows x86 arch:x86

2e8de13c2bcc7cb15b7bd94ae2f38e01

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

48:27:ff:0a:70:71:2b:0e:ed:87:3f:a0
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

20/04/2020, 07:49

Not After

21/04/2022, 07:49

Subject

CN=珠海市君天电子科技有限公司,O=珠海市君天电子科技有限公司,L=珠海市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:69:00:5d:bc:45:70:12:e3:71:66:72:1c:4c:b0:eb
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/04/2021, 00:00

Not After

20/04/2022, 23:59

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:47:91:0b:ed:f8:f9:18:ab:97:d8:77:44:18:0a:64:23:13:ff:69:4d:dc:58:87:14:ea:29:23:3d:fb:7c:cf
Signer

Actual PE Digest

b3:47:91:0b:ed:f8:f9:18:ab:97:d8:77:44:18:0a:64:23:13:ff:69:4d:dc:58:87:14:ea:29:23:3d:fb:7c:cf

Digest Algorithm

sha256

PE Digest Matches

false

d8:6b:97:34:5d:fe:61:95:98:43:6f:bc:3f:02:5f:6e:f2:3f:93:3f
Signer

Actual PE Digest

d8:6b:97:34:5d:fe:61:95:98:43:6f:bc:3f:02:5f:6e:f2:3f:93:3f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kanti\kanti\product\win32\dbginfo\ksapi.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
ExAllocatePoolWithTag
ProbeForRead
ExFreePoolWithTag
KeServiceDescriptorTable
RtlImageNtHeader
ZwClose
ObReferenceObjectByHandle
ObfDereferenceObject
ZwOpenKey
PsLookupProcessByProcessId
KeUnstackDetachProcess
LdrAccessResource
KeStackAttachProcess
LdrFindResource_U
IoDeleteDevice
IoFreeMdl
SeReleaseSubjectContext
SeCaptureSubjectContext
IofCompleteRequest
MmProbeAndLockPages
MmUnlockPages
IoCreateSymbolicLink
PsGetCurrentProcessId
IoCreateDevice
SeTokenIsAdmin
IoAllocateMdl
IoDeleteSymbolicLink
ZwUnmapViewOfSection
KeGetCurrentThread
ZwAllocateVirtualMemory
IoGetCurrentProcess
ZwFreeVirtualMemory
ExEventObjectType
MmCreateSection
NtClose
KeClearEvent
PsProcessType
MmMapViewOfSection
IoGetBaseFileSystemDeviceObject
KeWaitForSingleObject
IoFreeIrp
_wcsnicmp
IoGetRelatedDeviceObject
IoAllocateIrp
ZwMapViewOfSection
KeSetEvent
ExGetPreviousMode
ProbeForWrite
ObfReferenceObject
IoCreateFile
KeInitializeEvent
ZwCreateSection
MmHighestUserAddress
ObInsertObject
ExAllocatePoolWithQuotaTag
ObOpenObjectByPointer
IoFileObjectType
ZwQuerySymbolicLinkObject
_stricmp
wcsncpy
ZwOpenSymbolicLinkObject
IoGetDeviceObjectPointer
IoGetDeviceAttachmentBaseRef
KeBugCheckEx
IoCreateFileSpecifyDeviceObjectHint
RtlCompareUnicodeString
RtlCompareMemory
ZwOpenFile
ZwQueryObject
ObQueryNameString
ZwQueryValueKey
MmGetSystemRoutineAddress
ZwQuerySystemInformation
PsGetVersion
ZwSetValueKey
_strnicmp
ZwReadFile
ZwSetInformationFile
ZwQueryInformationFile
RtlEqualUnicodeString
ZwWaitForSingleObject
PsCreateSystemThread
ZwDuplicateObject
ZwOpenProcess
ZwSetInformationObject
ExDeleteNPagedLookasideList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
InterlockedPopEntrySList
MmUserProbeAddress
KeAddSystemServiceTable
wcschr
RtlVolumeDeviceToDosName
ZwCreateEvent
memmove
ZwQueryDirectoryFile
ZwQueryInformationProcess
RtlAnsiStringToUnicodeString
strrchr
_vsnwprintf
wcsrchr
SeDeleteObjectAuditAlarm
RtlImageDirectoryEntryToData
PsGetProcessSectionBaseAddress
MmIsAddressValid
_except_handler3
memset
memcpy

hal

KeGetCurrentIrql

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e8de13c2bcc7cb15b7bd94ae2f38e01

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

48:27:ff:0a:70:71:2b:0e:ed:87:3f:a0Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

0b:69:00:5d:bc:45:70:12:e3:71:66:72:1c:4c:b0:ebCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

b3:47:91:0b:ed:f8:f9:18:ab:97:d8:77:44:18:0a:64:23:13:ff:69:4d:dc:58:87:14:ea:29:23:3d:fb:7c:cfSigner

d8:6b:97:34:5d:fe:61:95:98:43:6f:bc:3f:02:5f:6e:f2:3f:93:3fSigner

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 84KB - Virtual size: 84KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 10KB - Virtual size: 13KB

PAGE Size: 512B - Virtual size: 156B

INIT Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 5KB - Virtual size: 4KB

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

48:27:ff:0a:70:71:2b:0e:ed:87:3f:a0
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

0b:69:00:5d:bc:45:70:12:e3:71:66:72:1c:4c:b0:eb
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

b3:47:91:0b:ed:f8:f9:18:ab:97:d8:77:44:18:0a:64:23:13:ff:69:4d:dc:58:87:14:ea:29:23:3d:fb:7c:cf
Signer

d8:6b:97:34:5d:fe:61:95:98:43:6f:bc:3f:02:5f:6e:f2:3f:93:3f
Signer

.text
Size: 84KB - Virtual size: 84KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 10KB - Virtual size: 13KB

PAGE
Size: 512B - Virtual size: 156B

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 5KB - Virtual size: 4KB