56e6f178fb15bfc82486e513d45aa570N

Sharing

Copy URL Twitter E-mail

General

Target

56e6f178fb15bfc82486e513d45aa570N
Size

104KB
MD5

56e6f178fb15bfc82486e513d45aa570
SHA1

bc69d0ad24efd3004226946f61b2e956ff54e102
SHA256

f41ca24a82d33805b87b478e5389c3b94569cef2280f20b4b158ac07973efc66
SHA512

5a4823931655d0bdc3a00388d60e85d37f06813ec186b08f8327e76edce718908e3bbb737b3fc0d9195dd015569fd67135c32fb4026d0ee469ed0d1c845bbaf8
SSDEEP

1536:BG12NV9dK5ExGmO5oInSsylKis3lm2x4u5MH5SW:fDKWGmOosyIk2xx+L

Score

1^/10

Malware Config

Signatures

Files

56e6f178fb15bfc82486e513d45aa570N
.dll windows:6 windows x86 arch:x86

729c6cea6eedf8f2a83238261c93d4f4

Code Sign

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2b
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

24/10/2018, 06:57

Not After

23/10/2020, 06:57

Subject

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:f3:0b:06:4f:34:cc:0a:de:19:df:c3:67:6b:cb:bc:69:a1:2e:4d:ff:f9:0e:f3:ac:d7:0b:68:08:d9:87:07
Signer

Actual PE Digest

6a:f3:0b:06:4f:34:cc:0a:de:19:df:c3:67:6b:cb:bc:69:a1:2e:4d:ff:f9:0e:f3:ac:d7:0b:68:08:d9:87:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\P4\SEC_FW\2\2.0_COMMON\CSE_SW\Src\Apps\Common\PMX\OneCore\objs\Pmx\PmxDll\Release\pmxdll.pdb

Imports

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryA
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

CreateEventA
InitializeCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
TlsAlloc
GetThreadPriority
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeGetTime
timeEndPeriod

idrvdll

_IDRVGetLastError@8
_IDRVInstallDriver@8
_IDRVRemoveDriver@8
_IDRVInit@8

api-ms-win-crt-string-l1-1-0

strncmp
memset
strcpy_s
strncpy
wcsncmp

api-ms-win-crt-stdio-l1-1-0

fflush
__acrt_iob_func
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

floor
_except1

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_beginthreadex
abort
_crt_at_quick_exit
terminate
_crt_atexit
_initialize_narrow_environment
_initterm_e
_initterm
_configure_narrow_argv
_seh_filter_dll
_cexit

api-ms-win-crt-heap-l1-1-0

_calloc_base
malloc
free
_malloc_base
_free_base

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-crt-convert-l1-1-0

atol

Exports

Exports

_PMxDestroy@0
_PMxGetLastError@8
_PMxIO@4
_PMxInit@8
_PMxMapPhys@4
_PMxPCI@4
_PMxUnmapPhys@4

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

729c6cea6eedf8f2a83238261c93d4f4

Code Sign

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2bCertificate

Extended Key Usages

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9fCertificate

Extended Key Usages

Key Usages

6a:f3:0b:06:4f:34:cc:0a:de:19:df:c3:67:6b:cb:bc:69:a1:2e:4d:ff:f9:0e:f3:ac:d7:0b:68:08:d9:87:07Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-mm-time-l1-1-0

idrvdll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 51KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 28KB - Virtual size: 46KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2b
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

6a:f3:0b:06:4f:34:cc:0a:de:19:df:c3:67:6b:cb:bc:69:a1:2e:4d:ff:f9:0e:f3:ac:d7:0b:68:08:d9:87:07
Signer

.text
Size: 51KB - Virtual size: 51KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 28KB - Virtual size: 46KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB