4fc254af8ebfa6fc1050f65c17015b39b36693b58f029c2fa1873976cbca52df

Sharing

Copy URL

Twitter E-mail

General

Target

4fc254af8ebfa6fc1050f65c17015b39b36693b58f029c2fa1873976cbca52df
Size

16KB
MD5

7cd54df7962a91032a643f152a79cd19
SHA1

261f76e625b0bc71a2cbf1e4b451555c2feeb959
SHA256

4fc254af8ebfa6fc1050f65c17015b39b36693b58f029c2fa1873976cbca52df
SHA512

664db9aa02dfebce1d4c6b9f42ba3887d3d3d2e409640fd66fce53ba1fd5cb4c36b5e3f3cbd14544b09546b5be63ad0c7b7a0eecc7ca0ab8a59d22ee6170b6a6
SSDEEP

192:WERtTm0ZfKb5ndqyvf9r8y7+B51l+qoDDv5bGBnTKBn9j8Lou7+wiz78gpyU:bfTm08b5dFf9QGb623JuY8EyU

Score

1^/10

Malware Config

Signatures

Files

4fc254af8ebfa6fc1050f65c17015b39b36693b58f029c2fa1873976cbca52df
.sys windows:10 windows x64 arch:x64

6ce252b51ed0e396ec3b0c3469195a1c

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20-05-2013 00:00

Not After

20-05-2014 23:59

Subject

CN=Shenzhen yundian Technology Co.\, Ltd,O=Shenzhen yundian Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:31

Not After

22-02-2021 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:62:86:25:96:bb:9f:a1:e9:6e:64:22:c9:94:f5:f9:2c:6f:b7:a1
Signer

Actual PE Digest

b0:62:86:25:96:bb:9f:a1:e9:6e:64:22:c9:94:f5:f9:2c:6f:b7:a1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Scode\KILLER\x64\Release\KILLER.pdb

Imports

ntoskrnl.exe

IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
PsSetCreateProcessNotifyRoutineEx
IoCreateSymbolicLink
KeStackAttachProcess
KeUnstackDetachProcess
ZwDeleteFile
ObReferenceObjectByName
__C_specific_handler
_local_unwind
IoDriverObjectType
KeBugCheckEx
IoCreateDevice
IofCompleteRequest
KeGetCurrentIrql
RtlCopyUnicodeString
DbgPrint
RtlInitUnicodeString
IoCreateFileSpecifyDeviceObjectHint
wcsstr

hal

HalReturnToFirmware

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ce252b51ed0e396ec3b0c3469195a1c

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

b0:62:86:25:96:bb:9f:a1:e9:6e:64:22:c9:94:f5:f9:2c:6f:b7:a1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 512B - Virtual size: 288B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 52B

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

b0:62:86:25:96:bb:9f:a1:e9:6e:64:22:c9:94:f5:f9:2c:6f:b7:a1
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 512B - Virtual size: 288B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 52B