eb85e4e39028691b32d640232c365ed0N

Sharing

Copy URL Twitter E-mail

General

Target

eb85e4e39028691b32d640232c365ed0N
Size

48KB
MD5

eb85e4e39028691b32d640232c365ed0
SHA1

994a40108545755fded26e0e47fc35696c9617e5
SHA256

a0d0d18196aaaa12efef25b799e5b04b762218401848811d3b62ec55b12a730d
SHA512

86ab3fa8276182c90eed23a99c876ec8d224d54a5f987771a4ec05bda6e2cb6a786c8ae3882fb55bd615d860d1cabfcaa3df1b6bbc09f933fbe2e71f9fd61f34
SSDEEP

1536:gZBnRPbGMi3BHxooyhpwYhSCPyfmlSZxb9Y:gZBnRSMipxFtYhSCPOESZY

Score

1^/10

Malware Config

Signatures

Files

eb85e4e39028691b32d640232c365ed0N
.sys windows:6 windows x64 arch:x64

e1b1c7983979e89e377b6b55b3bdf60b

Code Sign

5b:94:9a:40:11:d5:45:97:30:30:f4:7e:a6:7f:a8:d0
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

06/05/2015, 01:11

Not After

06/05/2016, 02:11

Subject

CN=北京迈捷利科技开发有限公司,O=北京迈捷利科技开发有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

49:16:95:d0:ee:64:aa:24:ea:e8:5d:be:12:55:1a:a0:89:f9:cd:27
Signer

Actual PE Digest

49:16:95:d0:ee:64:aa:24:ea:e8:5d:be:12:55:1a:a0:89:f9:cd:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\source\lsj\trunk\winpcap\packetntx\driver\bin\amd64\npf.pdb

Imports

ntoskrnl.exe

RtlWriteRegistryValue
MmProbeAndLockPages
PsGetVersion
ExInterlockedRemoveHeadList
RtlCompareMemory
MmUnlockPages
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
RtlAssert
DbgPrint
ZwEnumerateKey
IoAllocateMdl
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
KeSetEvent
ZwSetInformationThread
ObReferenceObjectByHandle
MmBuildMdlForNonPagedPool
KeReleaseSpinLockFromDpcLevel
MmMapLockedPagesSpecifyCache
KeWaitForSingleObject
KeAcquireSpinLockAtDpcLevel
KeBugCheckEx
IofCompleteRequest
RtlAppendUnicodeStringToString
ZwClose
ExEventObjectType
ExInterlockedInsertTailList
ZwQueryValueKey
IoFreeMdl
KeReleaseSpinLock
IoIs32bitProcess
RtlQueryRegistryValues
RtlAppendUnicodeToString
IoDeleteDevice
RtlInitUnicodeString
KeResetEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
KeClearEvent
ExAllocatePoolWithTag
__C_specific_handler

hal

KeQueryPerformanceCounter

ndis.sys

NdisFreePacket
NdisCloseAdapter
NdisOpenAdapter
NdisAllocatePacketPool
NdisInitializeEvent
NdisFreePacketPool
NdisAllocatePacket
NdisDeregisterProtocol
NdisRegisterProtocol
NdisWaitEvent
NdisSetEvent
NdisResetEvent
NdisSystemProcessorCount
NdisRequest
NdisUnchainBufferAtFront

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1b1c7983979e89e377b6b55b3bdf60b

Code Sign

5b:94:9a:40:11:d5:45:97:30:30:f4:7e:a6:7f:a8:d0Certificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

49:16:95:d0:ee:64:aa:24:ea:e8:5d:be:12:55:1a:a0:89:f9:cd:27Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 60B

5b:94:9a:40:11:d5:45:97:30:30:f4:7e:a6:7f:a8:d0
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

49:16:95:d0:ee:64:aa:24:ea:e8:5d:be:12:55:1a:a0:89:f9:cd:27
Signer

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 60B