1a44e6913def468ddf4ddd26d4528359dceb321573bd33375254750701d8b452

Sharing

Copy URL Twitter E-mail

General

Target

1a44e6913def468ddf4ddd26d4528359dceb321573bd33375254750701d8b452
Size

137KB
MD5

14dc9e87b77abf08e6e587ea9205e291
SHA1

5be54729e20281365e5a1dfc330f794395fc3fef
SHA256

1a44e6913def468ddf4ddd26d4528359dceb321573bd33375254750701d8b452
SHA512

833a504a624184d1b4e5382a1d8417f1515f123db24dbd7ebc9cddaa5db46ebed22ae7edb912e14e00f6262a18da2a89082b7cb13f49c1f74bbfcaf644228e65
SSDEEP

3072:npu/KnLQ+z99EU3gEyo6FABkqEpuaRRvRsRaRNNXpIadmGyuo:/LT7DgEyfAHWRJsRyNNqah2

Score

1^/10

Malware Config

Signatures

Files

1a44e6913def468ddf4ddd26d4528359dceb321573bd33375254750701d8b452
.zip
TeeDriverx64.sys
.sys windows:10 windows x64 arch:x64

2015a0d6e3b3bb0fa225485df17bec68

Code Sign

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:c3:fc:f0:e6:04:82:44:f7:2c:4e:cc:39:e2:f2:61:d6:c8:ae:d7
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

23/04/2018, 20:25

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2b
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

24/10/2018, 06:57

Not After

23/10/2020, 06:57

Subject

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/09/2018, 19:45

Not After

20/09/2019, 19:45

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:75:ea:94:4d:43:75:52:e0:ee:71:ec:cd:38:43:35:47:2a:6e:db:c7:6f:c4:8c:41:f0:6b:73:02:e1:3e:a7
Signer

Actual PE Digest

c3:75:ea:94:4d:43:75:52:e0:ee:71:ec:cd:38:43:35:47:2a:6e:db:c7:6f:c4:8c:41:f0:6b:73:02:e1:3e:a7

Digest Algorithm

sha256

PE Digest Matches

true

7e:c0:de:65:5a:4c:f2:5b:5e:48:1b:79:51:d9:a3:02:a8:90:b7:bd
Signer

Actual PE Digest

7e:c0:de:65:5a:4c:f2:5b:5e:48:1b:79:51:d9:a3:02:a8:90:b7:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\buildagent_prod\p4\1598850468\drivers\TeeDriver\TeeDriver\x64\PgTimersrelease\TEEDriverx64.pdb

Imports

ksecdd.sys

SecLookupWellKnownSid

ntoskrnl.exe

memcpy_s
RtlInitUnicodeString
RtlGUIDFromString
KeSetEvent
EtwWrite
RtlGetVersion
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeDelayExecutionThread
KeInitializeEvent
KeReadStateEvent
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIRegistrationControl
EtwRegister
ZwQueryInformationToken
MmMapIoSpace
MmUnmapIoSpace
PoRegisterPowerSettingCallback
PoUnregisterPowerSettingCallback
KeClearEvent
KeWaitForSingleObject
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
KeResetEvent
KeWaitForMultipleObjects
ZwPowerInformation
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlAnsiCharToUnicodeChar
KeBugCheckEx
ZwOpenProcessTokenEx
RtlEqualSid
RtlCopyUnicodeString
RtlValidSid
ZwClose
ExFreePoolWithTag
ExAllocatePoolWithTag
EtwUnregister

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
heci.PNF
heci.cat
heci.inf

Sharing

General

Malware Config

Signatures

Files

2015a0d6e3b3bb0fa225485df17bec68

Code Sign

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

19:c3:fc:f0:e6:04:82:44:f7:2c:4e:cc:39:e2:f2:61:d6:c8:ae:d7Certificate

Extended Key Usages

Key Usages

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2bCertificate

Extended Key Usages

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6dCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

c3:75:ea:94:4d:43:75:52:e0:ee:71:ec:cd:38:43:35:47:2a:6e:db:c7:6f:c4:8c:41:f0:6b:73:02:e1:3e:a7Signer

7e:c0:de:65:5a:4c:f2:5b:5e:48:1b:79:51:d9:a3:02:a8:90:b7:bdSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ksecdd.sys

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 173KB - Virtual size: 173KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 4B

PAGE Size: 17KB - Virtual size: 17KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 512B - Virtual size: 128B

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

19:c3:fc:f0:e6:04:82:44:f7:2c:4e:cc:39:e2:f2:61:d6:c8:ae:d7
Certificate

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2b
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

c3:75:ea:94:4d:43:75:52:e0:ee:71:ec:cd:38:43:35:47:2a:6e:db:c7:6f:c4:8c:41:f0:6b:73:02:e1:3e:a7
Signer

7e:c0:de:65:5a:4c:f2:5b:5e:48:1b:79:51:d9:a3:02:a8:90:b7:bd
Signer

.text
Size: 173KB - Virtual size: 173KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 4B

PAGE
Size: 17KB - Virtual size: 17KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 512B - Virtual size: 128B