fdf573b3bff6ca8c110835042c7e18e0N

Sharing

Copy URL

Twitter E-mail

General

Target

fdf573b3bff6ca8c110835042c7e18e0N
Size

1.8MB
MD5

fdf573b3bff6ca8c110835042c7e18e0
SHA1

39723208c65f57b72ac8fc95fd052b464091e241
SHA256

c8e9361e336d60a7fba11f5e8f63536adb721b6a200b3560b6a9a534808bebfa
SHA512

76e458025267170dbc2544aeefd2fd86842381c5b601557b62a4fc96285db0c4592151fc4bccaf0d5e5df35e2508c97f88fc33a5822af71feccc221c8546a141
SSDEEP

24576:SMpDmNR1hKqAPzBbhsFX3SghMUSNwDQN7Elhf6RTzRo:SMpDlqAbBbhu3SghzhC3o

Score

1^/10

Malware Config

Signatures

Files

fdf573b3bff6ca8c110835042c7e18e0N
.exe windows:6 windows x86 arch:x86

22c7fe4ccb0c99b998aac9ec43b2aec4

Code Sign

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2b
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

24-10-2018 06:57

Not After

23-10-2020 06:57

Subject

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28-10-2015 00:00

Not After

17-06-2021 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-04-2011 22:06

Not After

11-04-2021 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30-05-2014 16:35

Not After

17-03-2021 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20-04-2018 16:52

Not After

17-03-2021 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5a:f6:b8:8b:e2:9d:26:bf:4b:2a:89:e9:00:b9:85:1a:07:c6:48:f9:58:0a:2f:e9:31:48:d5:92:c5:e6:66:f0
Signer

Actual PE Digest

5a:f6:b8:8b:e2:9d:26:bf:4b:2a:89:e9:00:b9:85:1a:07:c6:48:f9:58:0a:2f:e9:31:48:d5:92:c5:e6:66:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\buildagent_prod_8811\p4\2076345971\sw\src\apps\system_tools\flash_programming_tool\fptw\Win32\Release\FPTW.pdb

Imports

api-ms-win-core-file-l1-1-0

SetFilePointerEx
CreateFileW
WriteFile
FindClose
FindFirstFileExA
FindNextFileA
CreateFileA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
GetFullPathNameW
FlushFileBuffers
GetFullPathNameA
ReadFile
SetEndOfFile

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
CreateEventA
InitializeCriticalSectionAndSpinCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetErrorMode

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FindResourceExW
LoadResource
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
LoadLibraryExA
FreeLibrary
LockResource
GetModuleFileNameA
LoadLibraryExW
SizeofResource
GetModuleHandleA

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
OpenThreadToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
OpenProcessToken
ExitProcess
GetStartupInfoW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute
GetConsoleScreenBufferInfo

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetEnvironmentStringsW
GetCommandLineW
SetEnvironmentVariableA
SetStdHandle
GetCurrentDirectoryW
GetCommandLineA
FreeEnvironmentStringsW

api-ms-win-security-base-l1-1-0

GetLengthSid
SetSecurityDescriptorGroup
DuplicateToken
SetSecurityDescriptorOwner
AddAccessAllowedAce
InitializeSecurityDescriptor
AdjustTokenPrivileges
SetSecurityDescriptorDacl
FreeSid
AllocateAndInitializeSid
InitializeAcl
IsValidSecurityDescriptor
AccessCheck

crypt32

CryptMsgGetParam
CryptMsgClose
CertGetNameStringA
CertFreeCertificateContext
CertFindCertificateInStore
CryptQueryObject
CertCloseStore

api-ms-win-devices-config-l1-1-1

CM_MapCrToWin32Err

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-shutdown-ansi-l1-1-0

InitiateSystemShutdownA

wintrust

WinVerifyTrust

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
ReadConsoleInputA
ReadConsoleW
GetConsoleCP
GetConsoleMode
SetConsoleMode
WriteConsoleW

api-ms-win-devices-config-l1-1-2

CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_List_SizeA

api-ms-win-core-localization-l1-2-0

GetCPInfo
FormatMessageA
IsValidCodePage
LCMapStringW
GetOEMCP
GetACP

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeW
CompareStringW
MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
HeapSize

api-ms-win-core-util-l1-1-0

DecodePointer

Sections

.text
Size: 337KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 625KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 830KB - Virtual size: 830KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22c7fe4ccb0c99b998aac9ec43b2aec4

Code Sign

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2bCertificate

Extended Key Usages

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9fCertificate

Extended Key Usages

Key Usages

5a:f6:b8:8b:e2:9d:26:bf:4b:2a:89:e9:00:b9:85:1a:07:c6:48:f9:58:0a:2f:e9:31:48:d5:92:c5:e6:66:f0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

crypt32

api-ms-win-devices-config-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-shutdown-ansi-l1-1-0

wintrust

api-ms-win-core-console-l1-1-0

api-ms-win-devices-config-l1-1-2

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-util-l1-1-0

Sections

.text Size: 337KB - Virtual size: 336KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 625KB - Virtual size: 646KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 830KB - Virtual size: 830KB

.reloc Size: 18KB - Virtual size: 17KB

56:00:00:08:2b:1e:36:c5:6b:00:27:6a:8a:00:00:00:00:08:2b
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

5a:f6:b8:8b:e2:9d:26:bf:4b:2a:89:e9:00:b9:85:1a:07:c6:48:f9:58:0a:2f:e9:31:48:d5:92:c5:e6:66:f0
Signer

.text
Size: 337KB - Virtual size: 336KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 625KB - Virtual size: 646KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 830KB - Virtual size: 830KB

.reloc
Size: 18KB - Virtual size: 17KB