a8e791ba2fd517f071e34789be56dba91276193f83eb96206c5b9f4f2405d98b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a8e791ba2fd517f071e34789be56dba91276193f83eb96206c5b9f4f2405d98b.exe
Size

32KB
MD5

d22901d208e2b1cfb7fab55353088fc9
SHA1

e217ee5b77ef35db60b7e93d5abcb44e010cac93
SHA256

a8e791ba2fd517f071e34789be56dba91276193f83eb96206c5b9f4f2405d98b
SHA512

bdbb47d4dc8bd4a1f950f099aa4509ca619ac4388e066b42711cc910c705b1a5f2f300789ec18fae1d36fa54c6b2147bd0d17f5139a413077328f9c8c7ecbd0a
SSDEEP

768:FKSLjLiShpmzuiY+VaHDtFLFbc0/3G3b9RYhTwMuPMR:FKSLIuim1FLGrUVwM2m

Score

1^/10

Malware Config

Signatures

Files

a8e791ba2fd517f071e34789be56dba91276193f83eb96206c5b9f4f2405d98b.exe
.sys windows:5 windows x64 arch:x64

7363079b9aae7d58bd33c691a613c83c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/06/2014, 09:16

Not After

03/09/2017, 09:16

Subject

CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,OU=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,L=New Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:00

Not After

23/05/2016, 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:95:e5:50:13:b0:f9:57:84:ae:c0:31:62:f9:68:b2:eb:ad:ba:c1
Signer

Actual PE Digest

8c:95:e5:50:13:b0:f9:57:84:ae:c0:31:62:f9:68:b2:eb:ad:ba:c1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
MmMapIoSpace
__C_specific_handler
ZwClose
ZwUnmapViewOfSection
MmUnmapIoSpace
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteSymbolicLink
IofCompleteRequest
IoDeleteDevice

hal

HalTranslateBusAddress
HalGetBusDataByOffset
HalSetBusDataByOffset

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7363079b9aae7d58bd33c691a613c83c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

8c:95:e5:50:13:b0:f9:57:84:ae:c0:31:62:f9:68:b2:eb:ad:ba:c1Signer

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 512B - Virtual size: 300B

.data Size: 512B - Virtual size: 88B

.pdata Size: 512B - Virtual size: 96B

INIT Size: 1024B - Virtual size: 600B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

8c:95:e5:50:13:b0:f9:57:84:ae:c0:31:62:f9:68:b2:eb:ad:ba:c1
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 300B

.data
Size: 512B - Virtual size: 88B

.pdata
Size: 512B - Virtual size: 96B

INIT
Size: 1024B - Virtual size: 600B