hvax64[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hvax64.exe
Size

1.2MB
MD5

d4a4f592f6b72fe3bec2b482cf6f3a8b
SHA1

f68ece8db3724d6d6c905f5d5667642f8c42af49
SHA256

b27f0614a6268fbca49c1a55c03be5f98c862b5838119ded67bd7e3fbdc4d092
SHA512

7ba051ee7d15911867c21969599c333ae9f4995fa0590ee70289e4de0bb68fc6b617af23bf875c539a2e1b5d3be471fb92de29cb1dde839459f95f683c9fd620
SSDEEP

24576:K+r1CAOeBc3yyHPy39F1kjupSU5tjjWpNkVoIKK3VJ:meBcCyy39AAjkkyw7

Score

1^/10

Malware Config

Signatures

Files

hvax64.exe
.exe windows:10 windows x64 arch:x64

d5aec1c1f764856cfb4155cee3321234

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:2d:02:7a:8d:42:86:f9:1b:e2:8a:87:05:57:55:d1:54:68:31:f7:b0:bf:30:3a:ea:c3:fb:8f:91:73:4d:5d
Signer

Actual PE Digest

e4:2d:02:7a:8d:42:86:f9:1b:e2:8a:87:05:57:55:d1:54:68:31:f7:b0:bf:30:3a:ea:c3:fb:8f:91:73:4d:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

hvax64.pdb

Imports

kdstub

KdInitializeLibrary

Exports

Exports

HvImageInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 106B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CONST
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

GFIDS
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5aec1c1f764856cfb4155cee3321234

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e4:2d:02:7a:8d:42:86:f9:1b:e2:8a:87:05:57:55:d1:54:68:31:f7:b0:bf:30:3a:ea:c3:fb:8f:91:73:4d:5dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kdstub

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 33KB - Virtual size: 1.9MB

.pdata Size: 50KB - Virtual size: 50KB

.idata Size: 512B - Virtual size: 106B

CONST Size: 6KB - Virtual size: 5KB

.edata Size: 512B - Virtual size: 73B

GFIDS Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 2KB - Virtual size: 1KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e4:2d:02:7a:8d:42:86:f9:1b:e2:8a:87:05:57:55:d1:54:68:31:f7:b0:bf:30:3a:ea:c3:fb:8f:91:73:4d:5d
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 33KB - Virtual size: 1.9MB

.pdata
Size: 50KB - Virtual size: 50KB

.idata
Size: 512B - Virtual size: 106B

CONST
Size: 6KB - Virtual size: 5KB

.edata
Size: 512B - Virtual size: 73B

GFIDS
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 2KB - Virtual size: 1KB