b3e3365312f44707785f78165d097274b632e025eb6872b6afa5558701c653c7N

Sharing

Copy URL Twitter E-mail

General

Target

b3e3365312f44707785f78165d097274b632e025eb6872b6afa5558701c653c7N
Size

30KB
MD5

f53d199b4aae12bb4132f5c50ffce5f0
SHA1

13cf473055762c52dfd0f1b0d1923390c47c9fae
SHA256

b3e3365312f44707785f78165d097274b632e025eb6872b6afa5558701c653c7
SHA512

73261c277bc4d5bfed62999a53ba38ca795dad342cb6942b886ab13eb10d52d46c9a5c59a0530cdf01635f876f24e2ba1b78aa346d0f1facbab88ca4b942ec23
SSDEEP

768:8u4jSdHcOYRElpxNiEfUCslTv+SjwL6OL0:83L0lpy2vslzi0

Score

1^/10

Malware Config

Signatures

Files

b3e3365312f44707785f78165d097274b632e025eb6872b6afa5558701c653c7N
.sys windows:10 windows x64 arch:x64

eab56d331fdfd48963384dc5b3ef6395

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:c4:fe:53:2c:a4:7d:2c:2e:f2:f0:00:03:00:00:c4:fe
Certificate

Issuer

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

02/07/2014, 16:20

Not After

16/06/2017, 16:20

Subject

CN=Intel Corporation - Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:2c:37:f2:00:01:00:00:00:0f
Certificate

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Not Before

08/02/2013, 22:20

Not After

08/02/2018, 22:30

Subject

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

01/02/2013, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:52:a4:d6:2e:f9:73:35:28:0e:9f:22:62:d9:9e:03:c7:4f:9f:2d
Signer

Actual PE Digest

1f:52:a4:d6:2e:f9:73:35:28:0e:9f:22:62:d9:9e:03:c7:4f:9f:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\1595\SSE_Storage_Common\build\iaStorF\x64\Release\iaStorF.pdb

Imports

ntoskrnl.exe

strncpy
RtlInitUnicodeString
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlGetVersion
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
IoAllocateIrp
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoDeleteDevice
IoDetachDevice
IoFreeIrp
IoFreeMdl
IoGetDeviceObjectPointer
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItemEx
IoIs32bitProcess
PoCallDriver
PoStartNextPowerIrp
ObfDereferenceObject
swprintf
__C_specific_handler
KeBugCheckEx

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eab56d331fdfd48963384dc5b3ef6395

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

33:00:00:c4:fe:53:2c:a4:7d:2c:2e:f2:f0:00:03:00:00:c4:feCertificate

Extended Key Usages

Key Usages

61:2c:37:f2:00:01:00:00:00:0fCertificate

Key Usages

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88Certificate

Extended Key Usages

Key Usages

1f:52:a4:d6:2e:f9:73:35:28:0e:9f:22:62:d9:9e:03:c7:4f:9f:2dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 64B

.pdata Size: 512B - Virtual size: 396B

PAGE Size: 3KB - Virtual size: 3KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

33:00:00:c4:fe:53:2c:a4:7d:2c:2e:f2:f0:00:03:00:00:c4:fe
Certificate

61:2c:37:f2:00:01:00:00:00:0f
Certificate

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88
Certificate

1f:52:a4:d6:2e:f9:73:35:28:0e:9f:22:62:d9:9e:03:c7:4f:9f:2d
Signer

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 64B

.pdata
Size: 512B - Virtual size: 396B

PAGE
Size: 3KB - Virtual size: 3KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B