f1f59fe37d830217d928620c3274a1dcb32b172d87825ce3ad86111daf800175

Sharing

Copy URL Twitter E-mail

General

Target

f1f59fe37d830217d928620c3274a1dcb32b172d87825ce3ad86111daf800175
Size

875KB
MD5

bdc9b55f85b31a063a1448080c77a04a
SHA1

4bedf3ac576aa228ec21bef6939c3e84beb47b14
SHA256

f1f59fe37d830217d928620c3274a1dcb32b172d87825ce3ad86111daf800175
SHA512

e1bd5c477826b399ad6b9129ffc715479401a590019c1ca51294015e349d42a5328d9ad9f3424bf936be6592c5bc18a8c8e6838b657b29ff701ca5f339a0e09b
SSDEEP

24576:LvitGyPmYq2bjE2qcMGQkEIM+q4NapePUOjoEsg4KzyMGO5:UPLq2bjgGPapePUOj+g4KzyMGO5

Score

1^/10

Malware Config

Signatures

Files

f1f59fe37d830217d928620c3274a1dcb32b172d87825ce3ad86111daf800175
.dll windows:6 windows x86 arch:x86

95d2e78e655862c0e72f88a90c129a70

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:45:5b:02:86:94:53:c0:4e:89:70:25:0d:1d:4e:24
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

19/04/2024, 00:00

Not After

17/04/2027, 23:59

Subject

SERIALNUMBER=12868358,CN=Wistron Corporation,O=Wistron Corporation,ST=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:aa:20:39:34:bf:41:33:03:4f:e5:a7:92:be:66:31:ac:6e:48:5a:0c:33:5a:00:64:32:28:a8:62:38:a4:e0
Signer

Actual PE Digest

55:aa:20:39:34:bf:41:33:03:4f:e5:a7:92:be:66:31:ac:6e:48:5a:0c:33:5a:00:64:32:28:a8:62:38:a4:e0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hid

HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetInputReport
HidD_GetManufacturerString
HidD_GetProductString
HidD_GetAttributes
HidD_GetIndexedString
HidD_GetSerialNumberString
HidP_GetCaps

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

kernel32

DeleteFileW
FindClose
FindNextFileW
CloseHandle
GetLastError
MultiByteToWideChar
CreateDirectoryW
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
CreateMutexW
CreateEventW
CreateThread
ReadFile
WriteFile
GetOverlappedResult
CancelIo
ReleaseMutex
WaitForSingleObject
Sleep
GetVersionExW
GetWindowsDirectoryW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TerminateThread
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineW
CreateFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
SetEndOfFile
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EncodePointer
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
OutputDebugStringW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapAlloc
LCMapStringW
GetStdHandle
GetFileType
FlushFileBuffers
HeapReAlloc
HeapSize
ReadConsoleW
WriteConsoleW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

advapi32

RegDeleteValueA
CryptReleaseContext
CryptGenRandom
RegCloseKey
CryptAcquireContextA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA

Exports

Exports

check_start
get_custom_info
get_fw_version
get_handle
get_string
load
pause_device
register_module
release_handle
reset
set_device_config
set_device_handler
set_device_info
set_device_path
set_message_callback
start
stop

Sections

.text
Size: 615KB - Virtual size: 615KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95d2e78e655862c0e72f88a90c129a70

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:45:5b:02:86:94:53:c0:4e:89:70:25:0d:1d:4e:24Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

55:aa:20:39:34:bf:41:33:03:4f:e5:a7:92:be:66:31:ac:6e:48:5a:0c:33:5a:00:64:32:28:a8:62:38:a4:e0Signer

Headers

DLL Characteristics

File Characteristics

Imports

hid

setupapi

kernel32

ole32

advapi32

Exports

Exports

Sections

.text Size: 615KB - Virtual size: 615KB

.rdata Size: 182KB - Virtual size: 182KB

.data Size: 24KB - Virtual size: 92KB

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 41KB - Virtual size: 40KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:45:5b:02:86:94:53:c0:4e:89:70:25:0d:1d:4e:24
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

55:aa:20:39:34:bf:41:33:03:4f:e5:a7:92:be:66:31:ac:6e:48:5a:0c:33:5a:00:64:32:28:a8:62:38:a4:e0
Signer

.text
Size: 615KB - Virtual size: 615KB

.rdata
Size: 182KB - Virtual size: 182KB

.data
Size: 24KB - Virtual size: 92KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 41KB - Virtual size: 40KB