a7b6b340e457d83eb3016ca4c64cdec0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a7b6b340e457d83eb3016ca4c64cdec0N.exe
Size

19KB
MD5

a7b6b340e457d83eb3016ca4c64cdec0
SHA1

3f9d2e209406634d6224fce4f76eed7ce3de272f
SHA256

a8f4f76946c3943625bd84abf1be0872c064ffc71249545ad8c97bea15e13c5b
SHA512

6303c83d617f1f1efcd8a41d9d8f976f784fd7af8f6c274c101840599f1990c70eeb24e4db8dd30bb8d6bbd51196b4dca74eb8d02a1732958da56161a37d3128
SSDEEP

192:2MosIxiDIuNvnqEvlI3a+QEc+PbbrGGQdf02vxU3SvBo6Q+L8PBxou7+wiz78/+:2MobA8uvvvluaY/AqeWa+uuY8m

Score

1^/10

Malware Config

Signatures

Files

a7b6b340e457d83eb3016ca4c64cdec0N.exe
.sys windows:10 windows x64 arch:x64

aa5cd8f28d46c362ca1088bace2f9f46

Code Sign

26:02:bb:9b:a2:ae:65:1a:ea:a7:9a:ec:38:a3:cb:3d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

06/05/2013, 00:00

Not After

06/05/2014, 23:59

Subject

CN=Anneng electronic Co. Ltd.,O=Anneng electronic Co. Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:72:c9:fe:4c:94:1a:8b:e3:cf:c9:f6:33:3f:60:50:1b:1a:48:d4
Signer

Actual PE Digest

a6:72:c9:fe:4c:94:1a:8b:e3:cf:c9:f6:33:3f:60:50:1b:1a:48:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\sys\MyDriver1.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlFreeUnicodeString
DbgPrintEx
RtlGetVersion
ExAllocatePoolWithTag
ExFreePoolWithTag
ProbeForRead
ProbeForWrite
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
MmIsAddressValid
PsGetProcessExitStatus
PsGetProcessId
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
IoThreadToProcess
ZwAllocateVirtualMemory
PsGetProcessPeb
PsGetProcessWow64Process
ObReferenceObjectByName
PsProcessType
PsThreadType
IoDriverObjectType
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa5cd8f28d46c362ca1088bace2f9f46

Code Sign

26:02:bb:9b:a2:ae:65:1a:ea:a7:9a:ec:38:a3:cb:3dCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

a6:72:c9:fe:4c:94:1a:8b:e3:cf:c9:f6:33:3f:60:50:1b:1a:48:d4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 568B

.pdata Size: 512B - Virtual size: 408B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

26:02:bb:9b:a2:ae:65:1a:ea:a7:9a:ec:38:a3:cb:3d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

a6:72:c9:fe:4c:94:1a:8b:e3:cf:c9:f6:33:3f:60:50:1b:1a:48:d4
Signer

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 568B

.pdata
Size: 512B - Virtual size: 408B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B