e64ab955ef0da37bc1cee3f3be47611872b20dc1922d72f8fca5feab6947183a

Sharing

Copy URL Twitter E-mail

General

Target

e64ab955ef0da37bc1cee3f3be47611872b20dc1922d72f8fca5feab6947183a
Size

1.0MB
MD5

ddc1214326296bccf725d9596b540151
SHA1

10977a824fb2ab03c247e850dc1512e96a3b85c9
SHA256

e64ab955ef0da37bc1cee3f3be47611872b20dc1922d72f8fca5feab6947183a
SHA512

248021b345ec23b295c2fc43073919fc1ade34c63106170c7511d4ae8a771c10108c6ad5207882b77968fd663fc2ce3f5324754c8af3c69617aa4fd19f778a72
SSDEEP

24576:hqoeqhGEo7C0ZXongQIo6ZJMGQ0xtSIzV19kkpBGvIhjssOrT:hqorhGv7NGngQIoKVQ0xhJkvEYsO3

Score

1^/10

Malware Config

Signatures

Files

e64ab955ef0da37bc1cee3f3be47611872b20dc1922d72f8fca5feab6947183a
.sys windows:10 windows x64 arch:x64

d38e42729517a8dabdab5a316104a7bd

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20/05/2013, 00:00

Not After

20/05/2014, 23:59

Subject

CN=Shenzhen yundian Technology Co.\, Ltd,O=Shenzhen yundian Technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:d5:f0:cb:1f:16:35:41:21:0e:22:92:a3:5f:c5:07:af:b3:a5:db
Signer

Actual PE Digest

69:d5:f0:cb:1f:16:35:41:21:0e:22:92:a3:5f:c5:07:af:b3:a5:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\驱动集合\DriverW\x64\Release\Driver.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString

Sections

.text
Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Dcode
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d38e42729517a8dabdab5a316104a7bd

Code Sign

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

69:d5:f0:cb:1f:16:35:41:21:0e:22:92:a3:5f:c5:07:af:b3:a5:dbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 32KB

.Dcode Size: 1.0MB - Virtual size: 1.0MB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

4e:fa:7e:7b:ba:65:ec:1a:b7:74:f2:b3:13:57:d5:99
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

69:d5:f0:cb:1f:16:35:41:21:0e:22:92:a3:5f:c5:07:af:b3:a5:db
Signer

.text
Size: 9KB - Virtual size: 32KB

.Dcode
Size: 1.0MB - Virtual size: 1.0MB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB