Cheremsha.zip
- SHA256 60b903d64745fb24b0c9c94104bcba80c171a877a56a787d2ec8e349f8e573cc
Overview
overview
9Static
static
3Cheremsha.zip
windows10-2004-x64
9Cheremsha.zip
windows11-ltsc_2024-x64
1al_w_gi.dll
windows10-2004-x64
5al_w_gi.dll
windows11-ltsc_2024-x64
5hyperland_driver.sys
windows10-2004-x64
3iqvw64e.sys
windows10-2004-x64
3iqvw64e.sys
windows11-ltsc_2024-x64
3statstrack_l1.exe
windows10-2004-x64
9statstrack_l1.exe
windows11-ltsc_2024-x64
9Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Cheremsha.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
Cheremsha.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
al_w_gi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
al_w_gi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral5
Sample
hyperland_driver.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral6
Sample
iqvw64e.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
iqvw64e.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
statstrack_l1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral9
Sample
statstrack_l1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
300 seconds
General
- Target Cheremsha.zip
- Size 12.1MB
- Sample261029-2hkvjatvbx
- SHA256 60b903d64745fb24b0c9c94104bcba80c171a877a56a787d2ec8e349f8e573cc
- MD5 e99ca70fcde3a5dd14b597ba7cfef728
- SHA1 34e7bdf4ca95aa1c160b97024265d0a4ef8b7858
- SHA512 2fe8c4c6526db329d4e0ba3f54c1ba2faaf0a6aba202162304c729ce459f245f6656e0d506e7707ad275c0097f5cc46d761fdc1f1381cea4fef0d0808c59075a
- SSDEEP 196608:QX7/ZdtEjakNPq1aLd7dhVjJVnCIx4Bs9qgvgxih5Zhn4QeSZu8a8WOZi68:QX7Bdtoak4oLdpfnnCfB23dh4QLjni68
- TLSH T199D6332258F54B3F50BE7683490B5F3F038C867386A6ADA9FFCF01499A8E58DD1B5508
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/al_w_gi.dll unpack001/statstrack_l1.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/hyperland_driver.sys unpack001/iqvw64e.sys
File Explorer
-
Cheremsha.zip.zip 12.1MB
-
al_w_gi.dll.dll 16.2MB
-
hyperland_driver.sys.sys 222KB
-
iqvw64e.sys.sys 33KB
-
statstrack_l1.exe.exe 825KB
al_w_gi.dll
- IMPHASH fc95a41caa86f714a8c170dfbd66a4ab
- SHA256 947ef60f767229d5d9b5a36db3c3522dfa33cb28e5b014e981e65308b76fd957
- MD5 d000c4e217da031f2f539e6d8dc139d2
- SHA1 2ed401c03eb32d480cee4c62be598f9ac4e63768
- SHA512 32fb0c5cd4a47d4c984132b8b00cca22675c99e56b914f00d3e79fa7c1306310da77b966621d95d7718d9194f67581c28b426cf4a7bc59ffd817f5be8a5a0eb2
- SSDEEP 196608:AziGFW97jkv5hTLC1qQtDGILFVaUDnY3+9HlsEZG4W6cwMx3D0Bnw0px:Azi5QbTL7Qti+83+9H57XB23sR
- TLSH T1800715A1D96C82DCD4547FA43E6FAA6C09222145350F9D5BD0782391AFAFAE433740EF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
962428
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetTickCount64
SizeofResource
FindResourceA
GetModuleHandleExA
LockResource
LoadResource
VirtualQuery
VirtualProtect
Sleep
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
CreateDirectoryA
GetModuleFileNameA
WriteFile
RtlVirtualUnwind
RtlLookupFunctionEntry
FreeLibraryAndExitThread
CreateFileA
DisableThreadLibraryCalls
CloseHandle
AddVectoredExceptionHandler
GetTickCount
FlushFileBuffers
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetLastError
HeapReAlloc
HeapAlloc
HeapDestroy
GetLocaleInfoA
GetCurrentProcessId
GetProcAddress
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapQueryInformation
HeapSize
GetFileSizeEx
GetConsoleOutputCP
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
FlsAlloc
GetFileType
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetThreadContext
GetModuleHandleW
GetStdHandle
ReadConsoleW
GetConsoleMode
FlushInstructionCache
GetWindowsDirectoryA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
user32
CallWindowProcA
SetWindowLongPtrA
GetAsyncKeyState
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
shell32
ShellExecuteW
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
491KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14.5MB
Virtual Size
14.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=184, id=261, version=33145,
count=39, id=260, version=33145,
count=24, id=259, version=33145,
count=15, id=260, version=35207,
count=12, id=259, version=35207,
count=85, id=261, version=35207,
count=15, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=50, id=265, version=35219,
count=3, id=259, version=35219,
count=1, id=255, version=35219,
count=1, id=151,
count=1, id=258, version=35219,
hyperland_driver.sys
- IMPHASH 96ba5fbb6f3a25a019dc32d2b3afd267
- SHA256 9cb333b8dec617d1231f5b68fc23726d47a7b3a07ac7ccf019c317fa8f594b6a
- MD5 b8caffe4de326af1db9e26741ee1e275
- SHA1 1121a4be953cab756d1b341cf979de68cdb73cf9
- SHA512 cb2b49e466d823d5a224cc3bf824954914fd46a319a13204e07a0362f1e4aebb59a8c47c955e3fc8f00e9ad978d5e37d991462ab71c032db2427602205fdcd23
- SSDEEP 6144:m5zvzt/Pge/bKznJGZSbZxAfoQ5RAqPWt:St/Pt/bKJK8ZxAfNJE
- TLSH T1AA247C5AF2E15DB4C097D274C656CB23EBB238090326A5DF45E0CE7A3B22BD0A63D745
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ab:77:3b:b1:68:dc:14:60:05:33:e5:da:2a:bf:d8:42:d2:6f:1f:81:59:eb:40:21:96:db:7f:20:58:c0:e2:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert shado\,134163473057556102
Chains
Oct 26, 2026
CN=WDKTestCert shado\,134163473057556102
Subject
CN=WDKTestCert shado\,134163473057556102
Serial Number
67:82:4c:cd:c6:c5:46:a8:49:33:a7:e6:3e:f7:94:77
Issuer
CN=WDKTestCert shado\,134163473057556102
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 23, 2026 - Feb 24, 2036
Minor OS version
0
Major OS version
10
Entry point
1323008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\shado\source\repos\statstrack_l1\x64\Release\hyperland_driver.pdb
ntoskrnl.exe
RtlCompareUnicodeString
KeDelayExecutionThread
IoReleaseRemoveLockEx
MmIsAddressValid
MmUnlockPages
KeAcquireSpinLockRaiseToDpc
PsGetProcessWow64Process
ZwWaitForSingleObject
KdDebuggerEnabled
IoReleaseRemoveLockAndWaitEx
PsGetProcessPeb
KeGetCurrentIrql
KeBugCheckEx
DbgPrintEx
ZwReadFile
KdDebuggerNotPresent
ExReleaseFastMutex
ZwCreateFile
ZwQueryDirectoryObject
MmBuildMdlForNonPagedPool
ObfDereferenceObject
IoAllocateMdl
PsCreateSystemThread
_vsnprintf
RtlInitUnicodeString
MmFreeContiguousMemory
KeInitializeSpinLock
IoDeleteDevice
IoInitializeRemoveLockEx
MmGetPhysicalAddress
IoGetCurrentProcess
IoDeleteSymbolicLink
RtlPrefixUnicodeString
KeReleaseSpinLock
KeStackAttachProcess
ZwAllocateVirtualMemory
PsGetProcessExitStatus
PsLookupProcessByProcessId
MmCopyMemory
PsGetCurrentProcessId
KeSetEvent
PsThreadType
ExAllocatePool2
ObReferenceObjectByHandle
ZwOpenDirectoryObject
KeClearEvent
IoRegisterShutdownNotification
ZwProtectVirtualMemory
PsGetProcessImageFileName
MmGetVirtualForPhysical
IoFreeMdl
ObfReferenceObject
ExAcquireFastMutex
IoAcquireRemoveLockEx
ExAllocatePoolWithTag
KeQuerySystemTimePrecise
IoUnregisterShutdownNotification
ExFreePoolWithTag
ZwFreeVirtualMemory
KeQueryActiveProcessorCount
KeInitializeEvent
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
IofCompleteRequest
ZwQueryInformationFile
KeWaitForSingleObject
IoCreateSymbolicLink
ZwClose
PsTerminateSystemThread
KeUnstackDetachProcess
KeGetCurrentProcessorNumberEx
KeInsertQueueDpc
KeGetProcessorNumberFromIndex
IoGetStackLimits
KeInitializeDpc
RtlDeleteElementGenericTableAvl
KeInitializeMutex
KeQueryMaximumProcessorCountEx
RtlRandomEx
KeEnterCriticalRegion
RtlUpcaseUnicodeChar
PsLoadedModuleList
RtlFreeUnicodeString
ExAcquireResourceExclusiveLite
KeSetTargetProcessorDpcEx
PsGetProcessId
MmGetPhysicalMemoryRangesEx2
MmProtectMdlSystemAddress
KeReleaseMutex
IoGetInitialStack
KeQueryActiveGroupCount
PsSetCreateProcessNotifyRoutineEx
KeLowerIrql
RtlGetVersion
RtlEnumerateGenericTableAvl
ExReleaseResourceLite
PsGetVersion
MmHighestUserAddress
MmAllocateContiguousMemorySpecifyCache
KeIpiGenericCall
KfRaiseIrql
MmAllocateContiguousMemory
PsSetCreateProcessNotifyRoutine
KeFlushQueuedDpcs
KeQueryActiveProcessorCountEx
RtlCompareMemory
KeLeaveCriticalRegion
MmGetSystemRoutineAddress
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
__C_specific_handler
hal
KeQueryPerformanceCounter
Name
.text
Size
180KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NHGVXO
Size
512B
Virtual Size
3B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=33145,
count=134, id=1, productName=Unmarked objects,
count=6, id=262, version=33145,
count=7, id=259, version=33145,
count=8, id=260, version=33145,
count=3, id=259, version=35219,
count=2, id=265, version=35219,
count=1, id=258, version=35219,
iqvw64e.sys
- IMPHASH 55db306bc2be3ff71a6b91fd9db051b8
- SHA256 4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b
- MD5 1898ceda3247213c084f43637ef163b3
- SHA1 d04e5db5b6c848a29732bfd52029001f23c3da75
- SHA512 84c3ccc657f83725b24a20f83b87577603f580993920cc42d6da58648c6888d950fd19fbb8b404ce51a3eab674066c5cefe275763fbdb32e1ae1ba98097ab377
- SSDEEP 384:gxdNvW7C8naMYCjizSO/YWwhtSgvNR0m1us7pfBMRKr+PLDRfvgXifBMRg6PWNTj:gHNwmJ/7UtSwR317uPPlvgXiu/6Tbf
- TLSH T109F23BC746186065E697C5FDC2B98B12CAF071981B24A3CF727481690F93FE87A3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2c:bf:e4:ad:0e:12:31:ff:3e:19:c1:9c:a9:31:1d:95:2c:e1:70:b7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US
Chains
Nov 14, 2013
CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US
Serial Number
27:76:ab:5c:f2:d0:98:72:f1:ad:05:fb:c3:f2:1a:87
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 17, 2012 - May 30, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
2
Major OS version
5
Entry point
6103552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb
ntoskrnl.exe
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetPhysicalAddress
DbgPrint
strncpy
vsprintf
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmUnmapIoSpace
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
RtlInitUnicodeString
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
ZwClose
RtlFreeAnsiString
strstr
RtlUnicodeStringToAnsiString
ZwEnumerateValueKey
ZwOpenKey
wcsncpy
IoGetDeviceObjectPointer
IoGetDeviceInterfaces
ObReferenceObjectByPointer
KeBugCheckEx
IoDeleteSymbolicLink
MmMapIoSpace
IoDeleteDevice
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
statstrack_l1.exe
- IMPHASH 8e5f34b16d11a9d73da6c3564b31b5a5
- SHA256 8d78180e893337ae2256aaf4d66771f90ca97c0cc6b739bf8ad10367583f6b5e
- MD5 ab7682085b9b022a689b969dda04669b
- SHA1 6b198e2e4a926b67deda17300c8943be2ae4e73e
- SHA512 c2d38a573f828b43c4f0507c9998b3f26c765f4041dd5e76caa72d48f5533c2db02c319afb4addcae9143886aec0cd353ac5ccfeefe2f29260e0a541751c1143
- SSDEEP 12288:NJ5kkx0oFFY941/Z2/rWI29sfO7y8OTRFoznhlgM:NjRFiG1Q/rWNGfO7u/0YM
- TLSH T1C705C0CDC506A6C6ED510831CE020127BFF8CBB45C47711295BDFA8679E2B581BEEEA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
548440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CreateFileA
AcquireSRWLockExclusive
GetLocalTime
ReleaseSRWLockExclusive
GetCurrentProcessId
GetTickCount
FlushFileBuffers
WriteConsoleW
WriteFile
GetCurrentProcess
AddVectoredExceptionHandler
GetModuleFileNameA
InitOnceComplete
InitOnceBeginInitialize
TryAcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
advapi32
SetSecurityInfo
GetSecurityInfo
GetSecurityDescriptorDacl
Name
.xk7m
Size
627KB
Virtual Size
627KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ho6z3
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nroAnch
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bootd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nroIAT
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nro0
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nroHMAC
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.boot
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.nro3
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nro2
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nro1
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=261, version=33145,
count=12, id=260, version=33145,
count=10, id=259, version=33145,
count=17, id=260, version=35207,
count=11, id=259, version=35207,
count=54, id=261, version=35207,
count=5, id=257, version=33145,
count=128, id=1, productName=Unmarked objects,
count=4, id=265, version=35219,
count=3, id=259, version=35219,
count=1, id=255, version=35219,
count=1, id=258, version=35219,