f989b52d-f928-44a3-9bf1-bf0c1da6a0d6_HyperV-DeviceVirtualization[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

f989b52d-f928-44a3-9bf1-bf0c1da6a0d6_HyperV-DeviceVirtualization.dll
Size

12KB
MD5

cf31fbe8ed6cb60c46f19f1c4d765a66
SHA1

b8fc28b77e4cf5e26b342883ac5fe39a15b61f5f
SHA256

34caf94b9846292f37b9667200546334a81051e25d97dc8e2ee7e9e09522d051
SHA512

923872ae4c38bd84a3d6f2ccaea9b5d0ef584621b16d95211e30bcf056e94bcbc919cbe056bcdeb9ed746758caceb30adad8b3eb298ce7fcfacc3045bf676ab3
SSDEEP

192:uwShAEqSq9WzshwWAAfD1S8f4DBQABJJzAv7T0q11qnajVtPxR:uwkqSq9WzshwWTD1IDBRJJ47Tplxb

Score

1^/10

Malware Config

Signatures

Files

f989b52d-f928-44a3-9bf1-bf0c1da6a0d6_HyperV-DeviceVirtualization.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:ee:10:59:94:ee:06:fe:43:eb:e5:75:26:c0:84:32:be:48:34:63:8a:38:ff:77:6b:88:c6:4e:7b:b5:44:c4
Signer

Actual PE Digest

ef:ee:10:59:94:ee:06:fe:43:eb:e5:75:26:c0:84:32:be:48:34:63:8a:38:ff:77:6b:88:c6:4e:7b:b5:44:c4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

f989b52d-f928-44a3-9bf1-bf0c1da6a0d6_HyperV-DeviceVirtualization.pdb

Sections

.rdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.apiset
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ef:ee:10:59:94:ee:06:fe:43:eb:e5:75:26:c0:84:32:be:48:34:63:8a:38:ff:77:6b:88:c6:4e:7b:b5:44:c4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.rdata Size: 512B - Virtual size: 456B

.apiset Size: 1024B - Virtual size: 604B

.rsrc Size: 1KB - Virtual size: 1KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ef:ee:10:59:94:ee:06:fe:43:eb:e5:75:26:c0:84:32:be:48:34:63:8a:38:ff:77:6b:88:c6:4e:7b:b5:44:c4
Signer

.rdata
Size: 512B - Virtual size: 456B

.apiset
Size: 1024B - Virtual size: 604B

.rsrc
Size: 1KB - Virtual size: 1KB