Freefn 2.zip
- SHA256 448a2d997965b2cdb0be6e799405df39e97a262d5443553b17d70a6a4e06261d
Static task
static1
1 signatures
General
- Target Freefn 2.zip
- Size 3.2MB
- Sample260813-x2pklswva1
- SHA256 448a2d997965b2cdb0be6e799405df39e97a262d5443553b17d70a6a4e06261d
- MD5 97b592aef3137642960d0a31a5a811a9
- SHA1 5a851fd350c42d8957fa3d0e4928b007c5fd2616
- SHA512 eb59d72005793639ada61edd0a7c9603d1ffb4b480beef5c210569b50e5d3b0723b20792f52745feb2edfd349c43867b076bda8aac87ed2f4a7028641ed9fa82
- SSDEEP 98304:66ObIvSY0+sn0Jy6mDFVJucYFpUPTRAP+Zti:6JUSl+q0JynRHY4+P+Zg
- TLSH T17DF533BEEF8434A9DC6C6FF4FCC22B70B0879046012386A5D14D55A5D81A3737BE5AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Freefn/AMIDEWIN.exe unpack001/Freefn/AMIDEWINx64.EXE unpack001/Freefn/Freefn.exe
File Explorer
-
Freefn 2.zip.zip 3.2MB
-
Freefn/AMIDEWIN.exe.exe 300KB
-
Freefn/AMIDEWINx64.EXE.exe 377KB
-
Freefn/AMIFLDRV64.SYS.sys 29KB
-
Freefn/Freefn.exe.exe 7.1MB
-
Freefn/amigendrv64.sys.sys 36KB
-
__MACOSX/._Freefn165B
-
__MACOSX/Freefn/._AMIDEWIN.exe207B
-
__MACOSX/Freefn/._AMIDEWINx64.EXE207B
-
__MACOSX/Freefn/._AMIFLDRV64.SYS207B
-
__MACOSX/Freefn/._Freefn.exe207B
-
__MACOSX/Freefn/._amigendrv64.sys207B
Freefn/AMIDEWIN.exe
- IMPHASH a728fce223c9b967a68d70ab5374fa1a
- SHA256 da35eabcd2ae42e0fe975454464eaef167156078e1260222127338ebc6e54473
- MD5 2b34156ed9893c771720273727607535
- SHA1 359f5c16a8f2c7e91e2b008b8cd62972ee6110e2
- SHA512 0fd4b41b7b9508ab407851bc5864527da68268040214a58106288fcb4f034caad4bc34a88570e7b6002a619a85414b1c8c8a871b60c85907f80d6d9c4d672f5c
- SSDEEP 6144:3CEHDrlz6+pK1NZzTu80d6P7NmNa5ElD:yKDpSD7NmN
- TLSH T188643900E502C030E4B200FD949B5FA89E686459675887EBB3FCD9B9AF631C59E7731E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
CreateServiceA
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
shell32
ShellExecuteA
kernel32
SetEndOfFile
SetStdHandle
GetCommandLineA
GetVersionExA
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExA
InitializeCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
UnhandledExceptionFilter
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
VirtualProtect
GetSystemInfo
VirtualQuery
GetSystemFirmwareTable
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
DeleteFileA
GetCurrentDirectoryA
IsWow64Process
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetConsoleCP
HeapSize
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetProcessHeap
user32
MessageBoxA
GetMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA
RegisterClassExA
ExitWindowsEx
BlockInput
SystemParametersInfoA
wsprintfA
DefWindowProcA
Name
.text
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=79, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Freefn/AMIDEWINx64.EXE
- IMPHASH e3d5de629e09ae6898196a1418661d7f
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- TLSH T10084F66AEB9220F0EC77917C88922306FBA075684771D7E7B7AD450A4F337E4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
SetHandleCount
LoadLibraryExW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetEndOfFile
SetStdHandle
GetSystemFirmwareTable
GetVersionExA
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
LocalSize
LocalAlloc
lstrlenA
FormatMessageA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
WriteConsoleW
SetFilePointer
GetProcessHeap
advapi32
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
CreateServiceA
shell32
ShellExecuteA
user32
ExitWindowsEx
RegisterClassExA
DefWindowProcA
DispatchMessageA
BlockInput
GetMessageA
MessageBoxA
CreateWindowExA
SystemParametersInfoA
TranslateMessage
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Freefn/AMIFLDRV64.SYS
- IMPHASH b05ee5c816a30bc52378c759486af0b9
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 13, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2019
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d3:d0:94:56:9d:0e:bd:83:06:00:00:00:00:00:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\work\dangerzone\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
394B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
954B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Freefn/Freefn.exe
- IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
- SHA256 325a6c39bfa237a1ec6561aa7180c07612387a50da83d2df8d69f20caa50045a
- MD5 d91e8cdc402b99557727063b5288e3a7
- SHA1 8952839433ac6e5ad5e14936a1a2556ddcea7d14
- SHA512 3f9dca611c9f8782237ff37b9d3be6083a7cb11aae12a9b83c28f7ae7329f986448b8a31c9a148e45b8a33e3fb3c6c7295922bd6f27b610d4cde982f1c01548c
- SSDEEP 49152:ekcLLPjqvEcIAxLEhxtaD9bWN6oJrhfENq1IbO4qJVxamb0MUc9nvJVgqNtrmabC:ek8rkZWYITakpNt9atLFumvBh8huTsE
- TLSH T1DE763947ECA514E9C0BDD1358963A622BF617C495B3123D32B90F2382F7ABE0AD79744
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
556288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
GetProcAddress
LoadLibraryExW
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
415KB
Virtual Size
32.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Freefn/amigendrv64.sys
- IMPHASH ce753744099dc03f568621989387593a
- SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
- MD5 9accebd928a8926fecf317f53cd1c44e
- SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
- SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
- SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
- TLSH T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:d7:a1:75:23:8d:96:93:2d:e6:e8:30:91:77:01:1f:90:68:76:96:a9:37:b6:66:2b:a6:d8:23:00:dc:f9:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 16, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
09:d7:a1:75:23:8d:96:93:2d:e6:e8:30:91:77:01:1f:90:68:76:96:a9:37:b6:66:2b:a6:d8:23:00:dc:f9:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2022
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9f:2b:45:35:15:08:2e:4b:5d:00:01:00:00:01:9f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AMIBIOS\Utility\AmiFlashDriver\AmiFlashDriverSrc\sys\x64\Release\amigendrv64.pdb
ntoskrnl.exe
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
MmGetPhysicalAddress
ZwUnmapViewOfSection
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlCompareMemory
KfRaiseIrql
MmMapIoSpace
MmUnmapIoSpace
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
KeLowerIrql
RtlGetVersion
hal
HalTranslateBusAddress
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=29395,
count=34, id=1, productName=Unmarked objects,
count=5, id=259, version=29395,
count=9, id=260, version=29395,
count=1, id=262, version=29395,
count=2, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=9, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,
__MACOSX/._Freefn
- SHA256 28802390f6e7e4f20bd378a105a5e66527b1bba5876e56bc4aba66ac34045086
- MD5 7c1b5d1bb51547d897273a13d18ad210
- SHA1 b22ae084a7fbabc03d3c5323644edf6b82bffc78
- SHA512 cfafebb4a8d74c0ede12eeb03a406ccf9b163355a1ff26f9ffc20fa2ba900bb05c77493673bb098c89cd580735f91c824df5494135d0f6f72b757963e516b1d4
- TLSH T1D4C012F457400302CC5264F074C92506F238C5661143331BF18F81800B1461169F416D
- MD5 SHA1 SHA512 TLSH
__MACOSX/Freefn/._AMIDEWIN.exe
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
__MACOSX/Freefn/._AMIDEWINx64.EXE
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
__MACOSX/Freefn/._AMIFLDRV64.SYS
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
__MACOSX/Freefn/._Freefn.exe
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
__MACOSX/Freefn/._amigendrv64.sys
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH