8ad1eacd0dee331a63e22c340e83d653ccf43e9844839ac88bfe4705de3a09f6

Sharing

Copy URL

Twitter E-mail

General

Target

8ad1eacd0dee331a63e22c340e83d653ccf43e9844839ac88bfe4705de3a09f6
Size

345KB
MD5

762f8dfa284db33bc0596e4f78a66217
SHA1

27b37655844607e84ae6e8b7aaf48a272f77ba3c
SHA256

8ad1eacd0dee331a63e22c340e83d653ccf43e9844839ac88bfe4705de3a09f6
SHA512

31be81343437ec718403dacdc7ae4015b6fea8e2e20047e98fd4866cc7859be376e42a4b29550d9cb1aabce109fd3292f504cc4b45c25a3ae078374e55a7234e
SSDEEP

6144:zLY+039TP8tD+8m6YjiHorIcxEtySDPoAG46Uvvxov7a/Ita:khEtnm6fk5my4G46CS2/Ma

Score

1^/10

Malware Config

Signatures

Files

8ad1eacd0dee331a63e22c340e83d653ccf43e9844839ac88bfe4705de3a09f6
.sys windows:10 windows x64 arch:x64

ec3b1772a7fc3484fcf2130bf6448f65

Code Sign

14:c2:ab:9d:bc:ca:63:4f:4e:b9:60:f4:18:57:dd:a1
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

03-06-2015 07:31

Not After

03-05-2016 08:10

Subject

CN=Wuhan Xianxingzhe Technology Company Limited,O=Wuhan Xianxingzhe Technology Company Limited,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-08-2013 20:28

Not After

15-08-2023 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:23:10:d1:e0:1f:4c:2b:b7:7a:42:81:27:ad:91:ec:9a:62:0b:27
Signer

Actual PE Digest

97:23:10:d1:e0:1f:4c:2b:b7:7a:42:81:27:ad:91:ec:9a:62:0b:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Imports

fltmgr.sys

FltEnumerateFilters
FltObjectDereference
FltSetCallbackDataDirty
FltDoCompletionProcessingWhenSafe
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltQueryInformationFile
FltSetInformationFile
FltClose

ntoskrnl.exe

ObfDereferenceObject
PsLookupProcessByProcessId
ObOpenObjectByPointer
KeInitializeApc
KeInsertQueueApc
PsProcessType
ExAllocatePoolWithTag
ExFreePoolWithTag
KeInitializeEvent
KeSetEvent
IoAllocateIrp
IofCallDriver
IoCreateFile
IoFreeIrp
IoGetRelatedDeviceObject
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
PsGetProcessId
RtlDowncaseUnicodeString
PsGetProcessWow64Process
PsGetProcessInheritedFromUniqueProcessId
KeStackAttachProcess
KeUnstackDetachProcess
ZwAllocateVirtualMemory
MmProbeAndLockPages
IoAllocateMdl
IoBuildDeviceIoControlRequest
IoFreeMdl
ZwCreateFile
DbgPrint
IofCompleteRequest
RtlCopyUnicodeString
MmMapLockedPagesSpecifyCache
IoGetCurrentProcess
ZwQueryInformationFile
PsGetCurrentProcessId
PsGetCurrentThreadId
IoReplaceFileObjectName
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
ZwWriteFile
PsGetThreadId
ExQueueWorkItem
CmUnRegisterCallback
PsTerminateSystemThread
ZwUnloadDriver
KeAcquireSpinLockRaiseToDpc
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
IoQueryFileDosDeviceName
ObReferenceObjectByHandle
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
PsThreadType
CmRegisterCallback
ObQueryNameString
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
PsLookupThreadByThreadId
IoThreadToProcess
IoCreateDevice
IoDeleteDevice
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeDelayExecutionThread
ZwFreeVirtualMemory
ZwWaitForSingleObject
ZwQuerySystemInformation
ZwQueryInformationThread
ExAllocatePool
wcscpy_s
RtlUnicodeStringToInteger
RtlCompareUnicodeString
KeQueryTimeIncrement
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPages
MmUnmapLockedPages
ZwOpenFile
ZwSetInformationFile
ZwReadFile
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
ZwOpenSymbolicLinkObject
RtlCharToInteger
RtlVolumeDeviceToDosName
ZwTerminateProcess
PsIsSystemThread
ZwOpenDirectoryObject
ZwQueryInformationProcess
PsGetProcessPeb
RtlImageNtHeader
MmSystemRangeStart
RtlUTF8ToUnicodeN
ExInterlockedInsertHeadList
IoCreateSymbolicLink
IoDeleteSymbolicLink
RtlGetVersion
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
KeBugCheckEx
PsCreateSystemThread
MmGetSystemRoutineAddress
KeWaitForSingleObject
__C_specific_handler
MmIsAddressValid
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenSection
ZwCreateSection
ProbeForWrite
ProbeForRead
ZwQuerySymbolicLinkObject
ZwClose
PsGetProcessSectionBaseAddress
KeReleaseSpinLock
RtlInitUnicodeString
PsSetCreateProcessNotifyRoutine
IoAttachDevice
IoDetachDevice
IoSetCompletionRoutineEx
strcpy_s

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec3b1772a7fc3484fcf2130bf6448f65

Code Sign

14:c2:ab:9d:bc:ca:63:4f:4e:b9:60:f4:18:57:dd:a1Certificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

97:23:10:d1:e0:1f:4c:2b:b7:7a:42:81:27:ad:91:ec:9a:62:0b:27Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

fltmgr.sys

ntoskrnl.exe

tdi.sys

Sections

.text Size: 195KB - Virtual size: 194KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 31KB - Virtual size: 55KB

.pdata Size: 8KB - Virtual size: 8KB

INIT Size: 5KB - Virtual size: 4KB

.vmp0 Size: 82KB - Virtual size: 82KB

.reloc Size: 512B - Virtual size: 424B

.rsrc Size: 512B - Virtual size: 488B

14:c2:ab:9d:bc:ca:63:4f:4e:b9:60:f4:18:57:dd:a1
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

97:23:10:d1:e0:1f:4c:2b:b7:7a:42:81:27:ad:91:ec:9a:62:0b:27
Signer

.text
Size: 195KB - Virtual size: 194KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 31KB - Virtual size: 55KB

.pdata
Size: 8KB - Virtual size: 8KB

INIT
Size: 5KB - Virtual size: 4KB

.vmp0
Size: 82KB - Virtual size: 82KB

.reloc
Size: 512B - Virtual size: 424B

.rsrc
Size: 512B - Virtual size: 488B