f3c551dd7a1ae36fe1d655a9b792fdd0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

f3c551dd7a1ae36fe1d655a9b792fdd0N.exe
Size

173KB
MD5

f3c551dd7a1ae36fe1d655a9b792fdd0
SHA1

00d197509b362aace670108bf0117978c54afe2b
SHA256

759c07169e949b3162d2a2f88d880f65cc3cd0f8a77ceef6b35ee761d17abf36
SHA512

03beff3c345bd92410277bdd4b5e345efcf3314fbe7373537ed71f35e8dc3852be35a6e18eaf600bbbb9eb4ea83e454274e7f9df1edbe4abdbe26119010b077c
SSDEEP

3072:A9Z6oAcu5xxnTgcaROtPTlu/BtwHzNotuV4e:A9Qd5xxnMc8O1mBtwu4v

Score

1^/10

Malware Config

Signatures

Files

f3c551dd7a1ae36fe1d655a9b792fdd0N.exe
.sys windows:6 windows x64 arch:x64

73a621d3be02111b9b3ad06c495b3680

Code Sign

45:cc:25:b7:2c:a6:0c:94:f9:bc:f7:90:eb:83:f0:01
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

09/02/2015, 07:51

Not After

09/02/2016, 07:51

Subject

CN=杭州升科计算机技术有限公司,O=杭州升科计算机技术有限公司,L=杭州市,ST=浙江省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d5:cb:00:3e:c2:40:cf:ab:4c:91:2b:58:5c:ab:cf:f4:9e:4e:62:93
Signer

Actual PE Digest

d5:cb:00:3e:c2:40:cf:ab:4c:91:2b:58:5c:ab:cf:f4:9e:4e:62:93

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\young\httprdr\tdxflt\objfre_win7_amd64\amd64\TdxFlt_amd64.pdb

Imports

ntoskrnl.exe

KeInitializeEvent
ZwClose
KeWaitForSingleObject
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
IoCancelIrp
ZwCreateFile
IofCompleteRequest
ObReferenceObjectByHandle
IoFreeIrp
MmProbeAndLockPages
IoAllocateMdl
IofCallDriver
ZwCreateKey
ExReleaseFastMutex
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
ExAcquireFastMutex
IoDeleteDevice
RtlAppendUnicodeToString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwSetValueKey
RtlFreeUnicodeString
IoGetDeviceObjectPointer
ExSystemTimeToLocalTime
ZwQueryValueKey
rand
KeQueryTimeIncrement
srand
RtlAppendUnicodeStringToString
ZwFlushKey
IoCreateDevice
ZwDeleteKey
ZwOpenKey
ExFreePoolWithTag
KeSetEvent
ExAllocatePool
KeAcquireSpinLockRaiseToDpc
IoDetachDevice
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
_strnicmp
strstr
_snprintf
strncpy
PsGetCurrentThreadId
DbgPrint
ZwEnumerateKey
ExAllocatePoolWithTag
ZwFsControlFile
IoAttachDeviceToDeviceStackSafe
ZwQuerySymbolicLinkObject
ZwReadFile
swprintf
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwSetInformationFile
ObQueryNameString
ZwWaitForSingleObject
PsCreateSystemThread
IoGetDeviceAttachmentBaseRef
IoCreateFileSpecifyDeviceObjectHint
ZwFlushBuffersFile
ZwDeleteFile
RtlCompareUnicodeString
ZwDeviceIoControlFile
RtlCopyUnicodeString
ZwOpenFile
ZwQueryInformationFile
ZwWriteFile
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
KeInitializeTimerEx
KeCancelTimer
KeBugCheckEx
KeReleaseSpinLock
RtlInitUnicodeString
RtlAnsiCharToUnicodeChar
__C_specific_handler

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73a621d3be02111b9b3ad06c495b3680

Code Sign

45:cc:25:b7:2c:a6:0c:94:f9:bc:f7:90:eb:83:f0:01Certificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79Certificate

Extended Key Usages

Key Usages

d5:cb:00:3e:c2:40:cf:ab:4c:91:2b:58:5c:ab:cf:f4:9e:4e:62:93Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 10KB - Virtual size: 21KB

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 380B

45:cc:25:b7:2c:a6:0c:94:f9:bc:f7:90:eb:83:f0:01
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

d5:cb:00:3e:c2:40:cf:ab:4c:91:2b:58:5c:ab:cf:f4:9e:4e:62:93
Signer

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 10KB - Virtual size: 21KB

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 380B