7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9

Sharing

Copy URL Twitter E-mail

General

Target
7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9
Size 1.6MB
Sample261027-kcy2jaswes
SHA256 7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9
MD5 dd249ef87a007e275ae42b87fd1496ab
SHA1 5c31883fd50fe935e4bad2a05f1a45da6db5541d
SHA512 fa5116e05843c17e9bada49102c1c6f2607e9066fd5262fc555f1e945c6269c5fc9214d6660438fee5e8dd6d0e3f4295f29cef13af19d9a56a5f2b0456c281f0
SSDEEP 49152:+0TqvXVlMymMxnZLCNpfU4X6PHeyzSePW2NOMd85IfaVpafZ5vfS:eZxnZw6rHDkQ78qlfvvfS
TLSH
T1FE7531876EEB1179C7AED73F4660A04FA721BE961751C2619A024F47FCBB0AF2538710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9

File Explorer

7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9

.sys 1.6MB

7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9

IMPHASH 7c4589448316e5e4a845845feeb7cbee
SHA256 7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9
MD5 dd249ef87a007e275ae42b87fd1496ab
SHA1 5c31883fd50fe935e4bad2a05f1a45da6db5541d
SHA512 fa5116e05843c17e9bada49102c1c6f2607e9066fd5262fc555f1e945c6269c5fc9214d6660438fee5e8dd6d0e3f4295f29cef13af19d9a56a5f2b0456c281f0
SSDEEP 49152:+0TqvXVlMymMxnZLCNpfU4X6PHeyzSePW2NOMd85IfaVpafZ5vfS:eZxnZw6rHDkQ78qlfvvfS
TLSH
T1FE7531876EEB1179C7AED73F4660A04FA721BE961751C2619A024F47FCBB0AF2538710
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

de:bf:c3:de:d7:fb:cc:e6:25:58:8e:92:5d:92:71:9d:65:9d:c4:1b:e2:48:99:6a:d1:2c:c4:0d:81:5d:1a:fe

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 19, 2026

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:3c:4a:61:fb:35:78:d2:b6:dd:00:00:00:00:01:3c

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

577408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

F:\ahsprotect\bin\x64\ahs_protect.pdb

ntoskrnl.exe

ExAllocatePool ExFreePoolWithTag KeInitializeEvent KeSetEvent KeDelayExecutionThread KeWaitForSingleObject PsCreateSystemThread PsTerminateSystemThread ObfDereferenceObject ZwClose PsGetCurrentProcessId PsLookupProcessByProcessId KeInitializeMutex KeReleaseMutex ExAllocatePoolWithTag ZwTerminateProcess ObOpenObjectByPointer PsProcessType RtlInitAnsiString RtlInitUnicodeString RtlAnsiStringToUnicodeString RtlCopyUnicodeString RtlxAnsiStringToUnicodeSize MmGetSystemRoutineAddress IoGetCurrentProcess PsGetProcessId PsGetProcessImageFileName swprintf PsThreadType strstr RtlUnicodeStringToAnsiString RtlCompareUnicodeString RtlFreeAnsiString RtlCompareMemory MmIsAddressValid ZwOpenProcess KeStackAttachProcess KeUnstackDetachProcess PsLookupThreadByThreadId ZwQueryObject ZwDuplicateObject ZwAllocateVirtualMemory ZwFreeVirtualMemory ObReferenceObjectByHandle ZwOpenFile IoQueryFileDosDeviceName IoFileObjectType PsGetProcessDebugPort NtDeviceIoControlFile RtlGetVersion ZwOpenKey ZwQueryValueKey strlen __C_specific_handler KdRefreshDebuggerNotPresent ZwCreateEvent ZwWaitForSingleObject ZwSetEvent KdPollBreakIn KdDebuggerNotPresent KdDebuggerEnabled KdEnteredDebugger KeInitializeSemaphore KeReleaseSemaphore KeWaitForMultipleObjects KeQueryTimeIncrement IoAcquireCancelSpinLock IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoReleaseCancelSpinLock KeBugCheckEx

Name

.text

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

xdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7face6a2f73215d5d05766b862cb42c70c094ace0b9c7500259cd7b2253a0dc9

PE Signature issue

ntoskrnl.exe

generic