cb9c8b4454a3257132dca0a2328bec9bfd717e70d450861cb48268139dd7a570[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cb9c8b4454a3257132dca0a2328bec9bfd717e70d450861cb48268139dd7a570.exe
Size

2.6MB
MD5

25799ae013825333698dfd9ac56fb506
SHA1

4d2d2e7646824d5f0a96510031f2d554273c98f7
SHA256

cb9c8b4454a3257132dca0a2328bec9bfd717e70d450861cb48268139dd7a570
SHA512

4dad1b2b3526c897170cee4497fa64aa6a5dcf57ef0792e9d25b83150b7feb67f4f3e631410efa843a47ad3bf0934447d77b9bcff97ba03ab84b54e633b3a367
SSDEEP

49152:o+qSDJRQRBFuD7YHHfc2LH+Zaxd8tUWQxp02zFtFIm:XqStRQ0PGk2KZy8Be02zJL

Score

1^/10

Malware Config

Signatures

Files

cb9c8b4454a3257132dca0a2328bec9bfd717e70d450861cb48268139dd7a570.exe
.sys windows:10 windows x64 arch:x64

5b5a8ac41e4686364ee284d420685479

Code Sign

61:3b:c7:91:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 20:15

Not After

15/04/2021, 20:25

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:97:11:45:cc:7a:0e:87:1d:14:71:7b:0a:04:1f:f4
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

09/07/2024, 05:56

Not After

09/07/2025, 05:56

Subject

CN=Open Source Developer\, Jun Liu,O=Open Source Developer,L=淮安市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:9f:5a:ff:ce:47:23:8d:f7:0b:42:ab:46:14:43:3a:e9:81:59:59
Signer

Actual PE Digest

0b:9f:5a:ff:ce:47:23:8d:f7:0b:42:ab:46:14:43:3a:e9:81:59:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\3.编程相关\1.源代码\VC\1.驱动代码\voouerDrv\Bin_Driver\voouerDrv_x64.pdb

Imports

fltmgr.sys

FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltReleaseFileNameInformation
FltRegisterFilter

netio.sys

WskDeregister
WskRegister
WskReleaseProviderNPI
WskCaptureProviderNPI

ntoskrnl.exe

IoDeleteSymbolicLink
IoGetCurrentProcess
ObfDereferenceObject
PsSetCreateProcessNotifyRoutine
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsGetProcessId
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
PsLookupThreadByThreadId
swprintf
__C_specific_handler
strlen
_stricmp
_strnicmp
strstr
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySystemInformation
RtlImageNtHeader
wcslen
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExGetPreviousMode
MmGetSystemRoutineAddress
MmIsAddressValid
NtTraceControl
ZwClose
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsGetProcessWow64Process
ProbeForWrite
PsGetCurrentProcessId
PsGetCurrentThreadId
sprintf
wcsstr
RtlInitString
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeAnsiString
ObReferenceObjectByHandle
ObCloseHandle
ZwQueryKey
RtlEqualString
PsGetThreadProcess
PsThreadType
strcmp
RtlUnicodeStringToInteger
RtlCompareUnicodeStrings
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlTimeToTimeFields
RtlGetVersion
KeDelayExecutionThread
KeQueryTimeIncrement
ProbeForRead
ExSystemTimeToLocalTime
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmMapIoSpace
MmUnmapIoSpace
IoAllocateMdl
IoFreeMdl
ZwCreateFile
ZwOpenFile
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenKey
ZwQueryValueKey
RtlCompareString
MmGetVirtualForPhysical
PsGetThreadProcessId
ZwDeviceIoControlFile
RtlCreateUnicodeString
RtlDowncaseUnicodeString
RtlCaptureContext
ObOpenObjectByPointer
_vsnwprintf
IoDeleteDevice
PsGetProcessImageFileName
ZwQueryInformationProcess
KeCapturePersistentThreadState
ObGetObjectType
PsProcessType
MmGetPhysicalAddress
MmCopyVirtualMemory
__chkstk
RtlRandomEx
RtlAppendUnicodeStringToString
KeInitializeEvent
ExAcquireFastMutex
ExReleaseFastMutex
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlWriteRegistryValue
RtlCreateRegistryKey
FsRtlIsNameInExpression
KeWaitForSingleObject
PsWrapApcWow64Thread
PsIsThreadTerminating
PsGetThreadTeb
KeInitializeApc
KeTestAlertThread
PsGetCurrentProcessWow64Process
KeInsertQueueApc
ZwWaitForSingleObject
ZwQueryInformationThread
KeResetEvent
ZwQueryInformationFile
ZwReadFile
ZwWriteFile
ZwCreateEvent
ZwDeleteFile
RtlImageDirectoryEntryToData
ExEventObjectType
KeSetEvent
IoAllocateIrp
IoFreeIrp
KeGenericCallDpc
MmAllocateContiguousMemory
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
ObReferenceObjectByPointer
KeSignalCallDpcDone
KeSignalCallDpcSynchronize
PsInitialSystemProcess
KeQueryActiveProcessorCountEx
MmFreeContiguousMemory
strncpy
IoDetachDevice
PoCallDriver
PoStartNextPowerIrp
IoAttachDeviceToDeviceStackSafe
ObReferenceObjectByName
IoDriverObjectType
strcpy
MmMapLockedPages
IoGetAttachedDeviceReference
IoEnumerateDeviceObjectList
ObQueryNameString
KeClearEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeReleaseGuardedMutex
ExAllocatePoolWithQuotaTag
ExAcquireRundownProtection
ExReleaseRundownProtection
ObfReferenceObject
SeLocateProcessImageName
IoThreadToProcess
ObInsertObject
ObCreateObject
PsReferenceProcessFilePointer
ExfAcquirePushLockShared
ExfReleasePushLockShared
ExInterlockedInsertTailList
ExInitializePushLock
ObCreateObjectType
ObRegisterCallbacks
ObUnRegisterCallbacks
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeTryToAcquireGuardedMutex
KeInitializeMutex
KeReleaseMutex
SeSinglePrivilegeCheck
IoIsSystemThread
ZwQueryObject
KeRaiseUserException
ZwSetInformationProcess
PsIsProcessBeingDebugged
PsCreateSystemThread
PsTerminateSystemThread
KeBugCheckEx
RtlInitAnsiString
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ExRaiseStatus
DbgPrint
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
PsGetProcessPeb

hal

KeQueryPerformanceCounter

wdfldr.sys

WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBind
WdfVersionBindClass

Sections

.text
Size: 519KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vu0
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b5a8ac41e4686364ee284d420685479

Code Sign

61:3b:c7:91:00:00:00:00:00:34Certificate

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

66:97:11:45:cc:7a:0e:87:1d:14:71:7b:0a:04:1f:f4Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0b:9f:5a:ff:ce:47:23:8d:f7:0b:42:ab:46:14:43:3a:e9:81:59:59Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

fltmgr.sys

netio.sys

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 519KB - Virtual size: 519KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 25KB - Virtual size: 95KB

.pdata Size: 20KB - Virtual size: 20KB

INIT Size: 7KB - Virtual size: 6KB

.vu0 Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 1024B - Virtual size: 556B

61:3b:c7:91:00:00:00:00:00:34
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

66:97:11:45:cc:7a:0e:87:1d:14:71:7b:0a:04:1f:f4
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0b:9f:5a:ff:ce:47:23:8d:f7:0b:42:ab:46:14:43:3a:e9:81:59:59
Signer

.text
Size: 519KB - Virtual size: 519KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 25KB - Virtual size: 95KB

.pdata
Size: 20KB - Virtual size: 20KB

INIT
Size: 7KB - Virtual size: 6KB

.vu0
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 1024B - Virtual size: 556B