a62348e9e4aca5f3441eea41a9f2d6125660fd3c54eb751fcaaf77df89e74264N

Sharing

Copy URL Twitter E-mail

General

Target

a62348e9e4aca5f3441eea41a9f2d6125660fd3c54eb751fcaaf77df89e74264N
Size

745KB
MD5

55cb78bcc575a44c4ea240aa73f958b0
SHA1

0a967aeeea6f2d35178f961ca7c8c44d1450e7b4
SHA256

a62348e9e4aca5f3441eea41a9f2d6125660fd3c54eb751fcaaf77df89e74264
SHA512

9cb351d07d5240adc5438b7f9d1485a773b1aa43f3688a9e3126fac2aeceb68a34e76933728cb46f6012e78ed6360cb742a48fc700aaabbd444af2799ba960f4
SSDEEP

12288:EhZcg8MJJtu7Zqt/YfJr/f8Uw5PQGnSx9er58cWtq2P7OhcACV7ObZTrgto1:EhZc9CJY7Z/f8Uw5PnSx9erZWtq2m7u0

Score

1^/10

Malware Config

Signatures

Files

a62348e9e4aca5f3441eea41a9f2d6125660fd3c54eb751fcaaf77df89e74264N
.sys windows:6 windows x86 arch:x86

4db7561b56b0e03869d5ef8c1b4b8ac0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d4:2f:fa:c1:ff:cd:b7:73:db:c6:f9:1d:c4:f0:2a:6c:e7:85:46:bb
Signer

Actual PE Digest

d4:2f:fa:c1:ff:cd:b7:73:db:c6:f9:1d:c4:f0:2a:6c:e7:85:46:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\autorelease\rtl8192ce\src_92ce\platform\ndis6\pci\objfre_win7_x86\i386\rtl8192ce.pdb

Imports

ntoskrnl.exe

RtlUnwind
KeBugCheckEx
KeTickCount
PoRegisterPowerSettingCallback
PoUnregisterPowerSettingCallback
WRITE_REGISTER_ULONG
WRITE_REGISTER_USHORT
WRITE_REGISTER_UCHAR
KeInitializeEvent
KeSetEvent
_alldiv
_aulldiv
_allmul
memcpy
KeQuerySystemTime
DbgPrint
_aullrem
_aulldvrm
_allshl
_vsnprintf
ExNotifyCallback
_aullshr
ExCreateCallback
RtlInitUnicodeString
ObfDereferenceObject
PsTerminateSystemThread
ZwClose
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
IoReleaseCancelSpinLock
IofCompleteRequest
IoAcquireCancelSpinLock
RtlAnsiStringToUnicodeString
RtlInitString
memset
MmMapLockedPagesSpecifyCache
IoWMIQueryAllData
IoWMIOpenBlock

hal

READ_PORT_ULONG
READ_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_UCHAR
KeStallExecutionProcessor
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql
READ_PORT_USHORT

ndis.sys

NdisMDeregisterScatterGatherDma
NdisMUnmapIoSpace
NdisMDeregisterInterruptEx
NdisFreeMdl
NdisFreeNetBufferList
NdisMSendNetBufferListsComplete
NdisMSynchronizeWithInterruptEx
NdisMRegisterInterruptEx
NdisMRegisterScatterGatherDma
NdisMRegisterMiniportDriver
NdisMIndicateReceiveNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMdl
NdisMFreeNetBufferSGList
NdisDeregisterDeviceEx
NdisMDeregisterIoPortRange
NdisQueueIoWorkItem
NdisFreeMemory
NdisCloseFile
NdisUnmapFile
NdisMapFile
NdisOpenFile
NdisInitializeString
NdisWriteConfiguration
NdisResetEvent
NdisWaitEvent
NdisMSetMiniportAttributes
NdisMRemoveMiniport
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisReadNetworkAddress
NdisReadConfiguration
NdisInitializeEvent
NdisMIndicateStatusEx
NdisMOidRequestComplete
NdisSetEvent
NdisSetTimer
NdisMCancelTimer
NdisAllocateMemoryWithTagPriority
NdisMSleep
NdisMInitializeTimer
NdisAllocateIoWorkItem
NdisFreeIoWorkItem
NdisMDeregisterMiniportDriver
NdisGetVersion
NdisMAllocatePort
NdisMNetPnPEvent
NdisMFreePort
NdisMAllocateSharedMemory
NdisMFreeSharedMemory
NdisMSetBusData
NdisMGetBusData
NdisWriteErrorLogEntry
NdisMRegisterIoPortRange
NdisMMapIoSpace
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisRegisterDeviceEx

Sections

.text
Size: 536KB - Virtual size: 535KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 709KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4db7561b56b0e03869d5ef8c1b4b8ac0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53Certificate

Extended Key Usages

Key Usages

d4:2f:fa:c1:ff:cd:b7:73:db:c6:f9:1d:c4:f0:2a:6c:e7:85:46:bbSigner

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text Size: 536KB - Virtual size: 535KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 132KB - Virtual size: 709KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 13KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

d4:2f:fa:c1:ff:cd:b7:73:db:c6:f9:1d:c4:f0:2a:6c:e7:85:46:bb
Signer

.text
Size: 536KB - Virtual size: 535KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 132KB - Virtual size: 709KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 13KB