cb0e554365b1504620394110d26ee5c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cb0e554365b1504620394110d26ee5c0N.exe
Size

108KB
MD5

cb0e554365b1504620394110d26ee5c0
SHA1

e42ba8829b40a39a4f81b3fb88f60b8030b09632
SHA256

efbc4a3ace72a3996eb8eeb5e3932be9636ec8caa0bfd94dabc8c52e91b4af18
SHA512

77c92e494ecb4d5804c077517114eb6b40c7f7cc119b0e87d68608d1e1ad564c5631bb569e788aca0d5a2897dc69aeb02ade80d07dcc6b4a46a785353fb3e7e0
SSDEEP

3072:D5zCz8ViLUWCQDwbkkG7zYgBLL9Y8Su+F:dM8OCQDwbkkG78gBLL9Y8Su0

Score

1^/10

Malware Config

Signatures

Files

cb0e554365b1504620394110d26ee5c0N.exe
.sys windows:6 windows x86 arch:x86

9e916e229b58d1ee1b307a01e8fbbd19

Code Sign

56:02:bf:7c:cf:77:06:95:c9:cd:90:f3:8e:5c:fb:87
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/12/2014, 00:00

Not After

11/12/2015, 23:59

Subject

CN=Shangrao Ruihai Information Technology Co.\, Ltd.,O=Shangrao Ruihai Information Technology Co.\, Ltd.,L=ShangRao,ST=JiangXi,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d5:5e:38:23:0b:48:8c:2a:9b:31:2c:3e:b4:18:41:2c:ac:b7:ff:24
Signer

Actual PE Digest

d5:5e:38:23:0b:48:8c:2a:9b:31:2c:3e:b4:18:41:2c:ac:b7:ff:24

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\young\httprdr\tdxflt\objfre_wxp_x86\i386\TdxFlt_i386.pdb

Imports

ntoskrnl.exe

ObReferenceObjectByHandle
ZwCreateFile
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
memset
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
IofCompleteRequest
IoCancelIrp
KeQueryTimeIncrement
KeTickCount
_alldiv
_allmul
ZwFlushKey
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
memcpy
IoDeleteDevice
IoGetDeviceObjectPointer
IoCreateDevice
ZwDeleteKey
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlLargeIntegerDivide
ExSystemTimeToLocalTime
KeQuerySystemTime
_allrem
rand
srand
RtlGetVersion
RtlRandomEx
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAllocatePool
ExAllocatePoolWithTag
IoDetachDevice
PsGetCurrentProcessId
RtlCompareMemory
MmIsAddressValid
ProbeForWrite
ProbeForRead
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
memmove
_snprintf
strncpy
PsGetCurrentThreadId
ZwEnumerateKey
DbgPrint
strstr
_strnicmp
ZwDeleteFile
IoBuildSynchronousFsdRequest
RtlCompareUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwReadFile
ZwWaitForSingleObject
ZwQueryInformationFile
IoCreateFileSpecifyDeviceObjectHint
IoGetDeviceAttachmentBaseRef
ZwOpenFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
ObQueryNameString
swprintf
ZwDeviceIoControlFile
ZwFsControlFile
KeGetCurrentThread
RtlCopyUnicodeString
IoAttachDeviceToDeviceStackSafe
PsCreateSystemThread
PsTerminateSystemThread
KeSetTimerEx
KeSetPriorityThread
KeCancelTimer
KeInitializeTimerEx
KeBugCheckEx
KeInitializeEvent
ObfDereferenceObject
KeWaitForSingleObject
ZwClose
RtlInitUnicodeString
ExFreePoolWithTag
KeSetEvent
RtlAnsiCharToUnicodeChar
RtlUnwind

hal

KfReleaseSpinLock
KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e916e229b58d1ee1b307a01e8fbbd19

Code Sign

56:02:bf:7c:cf:77:06:95:c9:cd:90:f3:8e:5c:fb:87Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d5:5e:38:23:0b:48:8c:2a:9b:31:2c:3e:b4:18:41:2c:ac:b7:ff:24Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 32KB - Virtual size: 31KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 4KB

56:02:bf:7c:cf:77:06:95:c9:cd:90:f3:8e:5c:fb:87
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d5:5e:38:23:0b:48:8c:2a:9b:31:2c:3e:b4:18:41:2c:ac:b7:ff:24
Signer

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 32KB - Virtual size: 31KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 4KB