5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc

Sharing

Copy URL Twitter E-mail

General

Target
5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc
Size 276KB
Sample260916-jfcf9sxaph
SHA256 5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc
MD5 364bc60084fbc9e46e3947de1a6e0abc
SHA1 a9868d64bfac799f6207415257fb23ec613f7f08
SHA512 02a92fd7b83ffb2715dc0dfd05f1d43640181a3c4282c5a891715c75bb43873848ed786d65387f48eb5e5720d3fa63d0b67aeb393d131ed626ab48e482551954
SSDEEP 6144:sXvCq+PXeg6vQBGxqhPCZHIm+4pvhtEjIYQo+I:3PXeg/Gwh1ipptEjI1o+I
TLSH
T1EF547E7BE9241CE6DE7AD234C8F50216D9B1B86893B1D7D743D2423A7A076E0EA3D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc

File Explorer

5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc

.sys 276KB

5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc

IMPHASH 6ab52d54387c561226d470ca436ba161
SHA256 5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc
MD5 364bc60084fbc9e46e3947de1a6e0abc
SHA1 a9868d64bfac799f6207415257fb23ec613f7f08
SHA512 02a92fd7b83ffb2715dc0dfd05f1d43640181a3c4282c5a891715c75bb43873848ed786d65387f48eb5e5720d3fa63d0b67aeb393d131ed626ab48e482551954
SSDEEP 6144:sXvCq+PXeg6vQBGxqhPCZHIm+4pvhtEjIYQo+I:3PXeg/Gwh1ipptEjI1o+I
TLSH
T1EF547E7BE9241CE6DE7AD234C8F50216D9B1B86893B1D7D743D2423A7A076E0EA3D344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bb:d3:00:86:58:75:57:21:46:dd:c1:57:74:a3:a1:20:67:10:a6:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Chains

Nov 2, 2011

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Revoked

Revocation Date

Aug 26, 2014

Timespan

Jan 22, 2004 - Jan 27, 2017

Subject

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Serial Number

01:00:00:00:00:01:2e:df:9f:72:ca

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2011 - Apr 21, 2012

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:0b:7f:6b:00:00:00:00:00:19

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

278716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\qzwang\workspace\inputsafe\winsrc\driver\objfre_wnet_amd64\amd64\keyscrambler.pdb

Name

.text

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

992B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5f4bf00f63d8757d57b52d2b447ef30c1d805a4309c970d4908b5ec8b3d8b9cc

PE Signature issue

ntoskrnl.exe

generic