Intel_GNA_3[.]00[.]00[.]1457[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Intel_GNA_3.00.00.1457.zip
Size

56KB
MD5

a19abb8e3c33b33ab6a5d71ed1950ccd
SHA1

a3fedf7218fba837cf02b49fdc1da354d446b0a6
SHA256

5fb7c9f14abe831b05a2a702302acaa6456fad6f1f2ade588d315f14c632029e
SHA512

3ed4db0514440de328ac388765cc5301e3e76bac5858b5e6cfc6e69df75216788425e7b85e5beeb731c4f8f7e50119030907ed1f19e7ea612e33544557d5209e
SSDEEP

1536:4CStxHqmwX6s5nUO2IxuJEi8UjnWNLV4h1PkB4B9XSgjRCAMvuGWUOhf7h:4C+b26s5UquJbr+LV4jP1DSURkuGWUOb

Score

1^/10

Malware Config

Signatures

Files

Intel_GNA_3.00.00.1457.zip
.zip
Intel_GNA_3.00.00.1457/CHANGELOG.md
Intel_GNA_3.00.00.1457/Instructions.txt
Intel_GNA_3.00.00.1457/gna.cat
Intel_GNA_3.00.00.1457/gna.inf
Intel_GNA_3.00.00.1457/gna.sys
.sys windows:10 windows x64 arch:x64

7479c003d299350576a73217bf2c56d4

Code Sign

dc:02:e2:a9:dc:e4:15:36:e7:d5:43:40:77:83:07:85
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/04/2021, 00:00

Not After

02/04/2023, 23:59

Subject

CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6
Signer

Actual PE Digest

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6

Digest Algorithm

sha256

PE Digest Matches

true

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6
Signer

Actual PE Digest

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

gna.pdb

Imports

ntoskrnl.exe

EtwRegister
EtwUnregister
KeGetCurrentIrql
KeLowerIrql
KfRaiseIrql
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoWMIRegistrationControl
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IoFreeMdl
__C_specific_handler
ExAllocatePoolWithTag
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
RtlGetVersion
MmGetSystemRoutineAddress
MmMapIoSpaceEx
MmUnmapIoSpace
RtlCopyUnicodeString
DbgPrintEx
RtlInitUnicodeString
RtlUnicodeStringToInteger
ProbeForWrite
EtwWriteTransfer

hal

KeQueryPerformanceCounter
KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Intel_GNA_3.00.00.1457/setup.cmd
.cmd .vbs

Sharing

General

Malware Config

Signatures

Files

7479c003d299350576a73217bf2c56d4

Code Sign

dc:02:e2:a9:dc:e4:15:36:e7:d5:43:40:77:83:07:85Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dcCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6Signer

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

PAGE Size: 11KB - Virtual size: 10KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 512B - Virtual size: 64B

dc:02:e2:a9:dc:e4:15:36:e7:d5:43:40:77:83:07:85
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6
Signer

2e:18:ae:d0:bf:41:59:86:54:d8:8f:11:c8:eb:dc:9d:4b:d7:b6:e9:97:f7:b6:d9:5a:5b:14:c8:6c:7b:54:c6
Signer

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

PAGE
Size: 11KB - Virtual size: 10KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 64B