3d9fcf59c8c70a9cc1edba1af68e394f466d29df8fc0798ac9a724bb96a0594f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3d9fcf59c8c70a9cc1edba1af68e394f466d29df8fc0798ac9a724bb96a0594f.exe
Size

34KB
MD5

ef735201030f6a62477ee7cbd0705d50
SHA1

37bb4e67572d728e7e62412850e132832579903a
SHA256

3d9fcf59c8c70a9cc1edba1af68e394f466d29df8fc0798ac9a724bb96a0594f
SHA512

3620c67d62cf8a749752fc9c2e635c6d28d0f795827d6d513d8b3e2243fb568d6719e453833cee1bdaf79df52551a0cb137c00702962d1f043eb04414e54f17b
SSDEEP

768:6a7EWKGqUq5dGaVGUcaZOgADZLvATCrzNmYCU/0qnxMH:LENGqTnGYtfAD9JNMnwxMH

Score

1^/10

Malware Config

Signatures

Files

3d9fcf59c8c70a9cc1edba1af68e394f466d29df8fc0798ac9a724bb96a0594f.exe
.sys windows:6 windows x64 arch:x64

0b5b97f322d5b3703fe2038c076eb4f3

Code Sign

24:b5:27:49:1b:e0:86:02:4b:79:a8:25:66:4d:d3:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/10/2013, 00:00

Not After

09/10/2015, 23:59

Subject

CN=New Horizon DataSys Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=New Horizon DataSys Inc.,L=Vancouver,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

00:43:02:f4:3a:c9:59:39:12:72:46:4b:0d:45:d6:0e:5f:27:10:40
Signer

Actual PE Digest

00:43:02:f4:3a:c9:59:39:12:72:46:4b:0d:45:d6:0e:5f:27:10:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\cvshome\shield6\core\driver\shdmount\objfre_win7_amd64\amd64\Shieldm.pdb

Imports

ntoskrnl.exe

MmUnmapLockedPages
ExAllocatePoolWithTag
MmAllocatePagesForMdlEx
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlCreateUnicodeString
IoRegisterShutdownNotification
IoBuildPartialMdl
_wcsnicmp
ZwReadFile
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
swprintf
KeInitializeEvent
ZwCreateDirectoryObject
RtlGetVersion
IoFreeMdl
MmFreeMappingAddress
KeDelayExecutionThread
RtlFreeUnicodeString
ZwMakeTemporaryObject
ZwCreateFile
MmMapLockedPagesWithReservedMapping
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoRegisterBootDriverReinitialization
ZwQueryValueKey
MmAllocateMappingAddress
ExInterlockedInsertTailList
PsTerminateSystemThread
MmUnmapReservedMapping
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
IoFreeIrp
IoAllocateIrp
ExInterlockedRemoveHeadList
IoCreateSymbolicLink
ObfDereferenceObject
MmFreePagesFromMdl
IoCreateDevice
ZwWriteFile
ObReferenceObjectByPointer
IoAllocateMdl
IofCallDriver
ZwOpenKey
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoFreeWorkItem
IoAllocateWorkItem
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
PoCallDriver
ObfReferenceObject
IoQueueWorkItem
KeBugCheckEx

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b5b97f322d5b3703fe2038c076eb4f3

Code Sign

24:b5:27:49:1b:e0:86:02:4b:79:a8:25:66:4d:d3:4aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

00:43:02:f4:3a:c9:59:39:12:72:46:4b:0d:45:d6:0e:5f:27:10:40Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 976B

.pdata Size: 1024B - Virtual size: 684B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 920B

24:b5:27:49:1b:e0:86:02:4b:79:a8:25:66:4d:d3:4a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

00:43:02:f4:3a:c9:59:39:12:72:46:4b:0d:45:d6:0e:5f:27:10:40
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 976B

.pdata
Size: 1024B - Virtual size: 684B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 920B