bb30ab4a699594359c3e3cbe5acefa59800795923562f28cde1b61b6c2129c4f

Sharing

Copy URL

Twitter E-mail

General

Target

bb30ab4a699594359c3e3cbe5acefa59800795923562f28cde1b61b6c2129c4f
Size

299KB
MD5

c4f0817ab830f7d379f4e3c0be3b0132
SHA1

ddf1015ed361973a86c2cc7bc7788327f900c791
SHA256

bb30ab4a699594359c3e3cbe5acefa59800795923562f28cde1b61b6c2129c4f
SHA512

3a5e4ab588c578300c4903143bf740096b2a89138baa1690f0d1e80ff532fe6750cb222d7cb31c90f40babbb8e664014a977b7e673b5ac7e008f61a5f77c9176
SSDEEP

6144:O6J9jkNsY5zk57Il0TWztMHjAl7sV0DyIk+9UASw5XWmgKd8FtczGVDqwv9:LJ9oNsY5zk57Il0i7TDyIkpwUjFtcsD7

Score

1^/10

Malware Config

Signatures

Files

bb30ab4a699594359c3e3cbe5acefa59800795923562f28cde1b61b6c2129c4f
.sys windows:10 windows x86 arch:x86

b744972c758e20fcd6c4c456686aa0f6

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:45

Not After

15-04-2021 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f5:a5:90:39:c5:5d:cb:ff:6e:a3:d7:00:c8:a8:93
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15-06-2018 00:00

Not After

12-09-2021 12:00

Subject

SERIALNUMBER=HRA 501412,CN=Thesycon Software Solutions GmbH & Co. KG,O=Thesycon Software Solutions GmbH & Co. KG,L=Ilmenau,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954687572696e676961,1.3.6.1.4.1.311.60.2.1.3=#13024445

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:c6:4e:4b:18:fa:93:6f:94:80:45:42:d5:1c:b4:15:cc:94:73:bf:c1:7e:3f:e0:69:43:ef:9c:39:ce:55:3f
Signer

Actual PE Digest

b5:c6:4e:4b:18:fa:93:6f:94:80:45:42:d5:1c:b4:15:cc:94:73:bf:c1:7e:3f:e0:69:43:ef:9c:39:ce:55:3f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\wrk\prj\_Thesycon\USB\TUSBAudio\_main\bin\Release\Win32\tusbaudio.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
PoStartNextPowerIrp
_purecall
IofCallDriver
KeInitializeEvent
IoInvalidateDeviceRelations
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
RtlFreeUnicodeString
IoDeleteDevice
IoInitializeRemoveLockEx
IoCreateDevice
RtlGetVersion
PoCallDriver
PoRequestPowerIrp
MmAllocatePagesForMdlEx
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmFreePagesFromMdl
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
PoSetPowerState
IoDetachDevice
IoAttachDeviceToDeviceStack
IoGetDeviceProperty
KeSetEvent
KeClearEvent
RtlGUIDFromString
RtlInitUnicodeString
ZwCreateKey
IoOpenDeviceRegistryKey
RtlQueryRegistryValues
ZwDeleteValueKey
ZwEnumerateKey
ZwQueryValueKey
ZwClose
ZwSetValueKey
IofCompleteRequest
ObfDereferenceObject
ObReferenceObjectByHandle
ExEventObjectType
MmUnlockPages
MmProbeAndLockPages
IoCancelIrp
IoBuildSynchronousFsdRequest
KeSetTimer
IoAllocateWorkItem
KeInitializeDpc
KeInitializeTimer
KefReleaseSpinLockFromDpcLevel
KeCancelTimer
IoFreeWorkItem
KefAcquireSpinLockAtDpcLevel
IoQueueWorkItem
IoFreeIrp
IoAllocateIrp
KeInsertQueueDpc
IoReuseIrp
KeDelayExecutionThread
IoWriteErrorLogEntry
RtlVerifyVersionInfo
VerSetConditionMask
IoAllocateErrorLogEntry
KeRestoreFloatingPointState
KeSaveFloatingPointState
_vsnwprintf
KeQuerySystemTime
KeTickCount
KeQueryPriorityThread
KeGetCurrentThread
KeSetPriorityThread
KeSetBasePriorityThread
_vsnprintf
IoGetAttachedDeviceReference
ExIsProcessorFeaturePresent
RtlIsNtDdiVersionAvailable
KeResetEvent
KeBugCheckEx
memcpy
RtlUnwind
ExFreePoolWithTag
ExAllocatePoolWithTag
ObfReferenceObject
KeReleaseMutex
KeInitializeMutex
IoReleaseRemoveLockAndWaitEx
IoReleaseRemoveLockEx
ZwOpenKey
IoAcquireRemoveLockEx
_alldiv
_allmul
_allshl
_aulldiv
memset

hal

ExAcquireFastMutex
KeGetCurrentIrql
KeQueryPerformanceCounter
KfAcquireSpinLock
KfReleaseSpinLock
ExReleaseFastMutex

usbd.sys

_USBD_CreateConfigurationRequestEx@8

Sections

.text
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b744972c758e20fcd6c4c456686aa0f6

Code Sign

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

03:f5:a5:90:39:c5:5d:cb:ff:6e:a3:d7:00:c8:a8:93Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

b5:c6:4e:4b:18:fa:93:6f:94:80:45:42:d5:1c:b4:15:cc:94:73:bf:c1:7e:3f:e0:69:43:ef:9c:39:ce:55:3fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

usbd.sys

Sections

.text Size: 240KB - Virtual size: 239KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 512B - Virtual size: 352B

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 10KB - Virtual size: 9KB

61:20:4d:b4:00:00:00:00:00:27
Certificate

03:f5:a5:90:39:c5:5d:cb:ff:6e:a3:d7:00:c8:a8:93
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

b5:c6:4e:4b:18:fa:93:6f:94:80:45:42:d5:1c:b4:15:cc:94:73:bf:c1:7e:3f:e0:69:43:ef:9c:39:ce:55:3f
Signer

.text
Size: 240KB - Virtual size: 239KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 512B - Virtual size: 352B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 10KB - Virtual size: 9KB