cb85dfbfc660ec9102b07caa6e66af3b62d7bbdbcd257083d060d5d884bd87cc

Sharing

Copy URL Twitter E-mail

General

Target

cb85dfbfc660ec9102b07caa6e66af3b62d7bbdbcd257083d060d5d884bd87cc
Size

173KB
MD5

cc9aee22bb89312857a839d37e53ddb1
SHA1

7424e791a714611e5a5dca39ce72606385dcbb9c
SHA256

cb85dfbfc660ec9102b07caa6e66af3b62d7bbdbcd257083d060d5d884bd87cc
SHA512

66aeb54ffb3265acd381bc10c14301b6f7fe2e5461ac9a9e13a22cb2df07ec09b6ac7a20ad5f066d657bf5e42fb413a2b72321dab28bbe79234aecff82f050e7
SSDEEP

3072:uepT2TbcnzzW44AIUxtS3NTQbg6bWJ2c8hZ+8iu7Ibf3a8Y0rRAXoLjHwSIisu2x:ueubPJQb3+WZr0FYGzRIBx

Score

1^/10

Malware Config

Signatures

Files

cb85dfbfc660ec9102b07caa6e66af3b62d7bbdbcd257083d060d5d884bd87cc
.sys windows:10 windows x64 arch:x64

f73f24228894974aef90f517b5c53650

Code Sign

25:9b:ae:11:56:28:d3:82
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/09/2021, 12:19

Not After

01/09/2026, 12:19

Subject

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:4e:ed:bc:14:9e:9e:e0:74:1a:c0:af:21:df:32:d6:62:c4:28:c2:82:00:39:4a:4b:ea:9f:f2:8e:ed:5a:0f
Signer

Actual PE Digest

24:4e:ed:bc:14:9e:9e:e0:74:1a:c0:af:21:df:32:d6:62:c4:28:c2:82:00:39:4a:4b:ea:9f:f2:8e:ed:5a:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

NtOpenFile
__chkstk
RtlInitUnicodeString
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlGetVersion
KeDelayExecutionThread

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f73f24228894974aef90f517b5c53650

Code Sign

25:9b:ae:11:56:28:d3:82Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

24:4e:ed:bc:14:9e:9e:e0:74:1a:c0:af:21:df:32:d6:62:c4:28:c2:82:00:39:4a:4b:ea:9f:f2:8e:ed:5a:0fSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: - Virtual size: 320B

.pdata Size: 1024B - Virtual size: 516B

INIT Size: 512B - Virtual size: 290B

25:9b:ae:11:56:28:d3:82
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

24:4e:ed:bc:14:9e:9e:e0:74:1a:c0:af:21:df:32:d6:62:c4:28:c2:82:00:39:4a:4b:ea:9f:f2:8e:ed:5a:0f
Signer

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 320B

.pdata
Size: 1024B - Virtual size: 516B

INIT
Size: 512B - Virtual size: 290B