Win32.Stuxnet.B.Duqu-Realtek.zip
- SHA256 7dafe09a44e72c7b6522319e40c3fadcbad7a0b42d584988a1be8de818689896
Password
infected
Behavioral task
behavioral1
Sample
Win32.Stuxnet.B.Duqu-Realtek.zip
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
signed drivers/0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.sys
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
signed drivers/1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.sys
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
signed drivers/63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.sys
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral5
Sample
signed drivers/70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b.dll
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target Win32.Stuxnet.B.Duqu-Realtek.zip
- Size 55KB
- Sample261111-jelcsaff23
- SHA256 7dafe09a44e72c7b6522319e40c3fadcbad7a0b42d584988a1be8de818689896
- MD5 c5d82342430cfd542bc287b178025e5f
- SHA1 d7dddcc72f69cb9b11e7034a32d5308b27b09add
- SHA512 2af2bd38593be1d3f5e6043e2c1da506105ba9a2bfd18d6cee796008860963d2bf74bf9548455e5869a1ba65ef28b8c96d60f0f74ebc9327554b50c7fd5916c7
- SSDEEP 1536:eA+MutyypmyTYK7xtqUSi9QBqRJNsGrTEfmaJ:1+Mj+YixtqUSiDRJNsGvGmaJ
- TLSH T155430148FD076ADAE37E24B03E5109D4A3F012A674EDA619E0907BDD768E0025F369FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stuxnet 1 IoCs
resource yara_rule static1/unpack001/signed drivers/70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b family_stuxnet - Untrusted Codesign Signers 4 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/signed drivers/0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198 unpack001/signed drivers/1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c unpack001/signed drivers/63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802 unpack001/signed drivers/70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b
File Explorer
-
Win32.Stuxnet.B.Duqu-Realtek.zip.zip 55KB
-
signed drivers/0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.sys 16KB
-
signed drivers/1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c.sys 25KB
-
signed drivers/63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802.sys 24KB
-
signed drivers/70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b.dll 25KB
signed drivers/0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198
- IMPHASH f17abd1ac12e63539154261b80dd7896
- SHA256 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198
- MD5 cc1db5360109de3b857654297d262ca1
- SHA1 758240613c362bb1fd13e07d3d19f357b7f8a6da
- SHA512 63492d7be766606e3102f6444d94676a068378d7cf85d5bec27062f5fb9cc99bc8a34ee32d173b5a392d4773464327296985a0a7fc1fe27cdd8e060278f4ec28
- SSDEEP 384:MYJsx/EzZYCb6NdEVAFba2iWs7pyWy0YJLWd6jqdybm:MYSx/ElbAdbY7p+ZLAmIybm
- TLSH T17D72F69637911034ECD72BB0889EF623B739F2821FA156C7216946CE6C427E17F3964E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
38:b1:8f:60:bc:51:49:15:b0:e5:34:c4:3e:a9:53:e1:6c:ac:59:88
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Chains
Jan 25, 2010
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Serial Number
5e:6d:dc:87:37:50:82:84:58:14:f4:42:d1:d8:2a:25
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 15, 2007 - Jun 11, 2010
Minor OS version
0
Major OS version
6
Entry point
8197
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb
ntoskrnl.exe
IoCreateDevice
IoDeleteDevice
IoRegisterFsRegistrationChange
ObfDereferenceObject
IoDriverObjectType
RtlInitUnicodeString
MmGetSystemRoutineAddress
IofCompleteRequest
KeDelayExecutionThread
ExFreePoolWithTag
ExAllocatePool
IofCallDriver
IoDetachDevice
IoAttachDeviceToDeviceStack
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeWorkItem
MmMapLockedPagesSpecifyCache
IoQueueWorkItem
IoAllocateWorkItem
toupper
memmove
KeTickCount
KeBugCheckEx
RtlUnwind
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
256B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
896B
Virtual Size
770B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=29, id=1, productName=Unmarked objects,
count=3, id=19, version=9049,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
signed drivers/1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c
- IMPHASH e479290b25b0e1240c9981c53a12abb9
- SHA256 1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c
- MD5 f8153747bae8b4ae48837ee17172151e
- SHA1 cb0793029c60c0bd059ff85de956619f7fdeb4fd
- SHA512 91c9e7e94f5fd82d8dfd0ebae7bcad3c9726fa4061a7650bc543341a64ab946783b915346ff77e1210d88e0de1e40f1285f385c0964a0651160ab35763d064b6
- SSDEEP 384:GjBfuuPC3LNGL9BLKkVcr7mj3eSW0lhqaWd7pxW3KzMdYJLWd6jqdybI:mfuj3oLukV0mTeSJhm7p+KxLAmIybI
- TLSH T16AC26E837B902965EC950F3089EEEB62EDB6F1602A91C55703640D8E2F56BF06735B0F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
64:1a:97:0f:49:95:f6:a3:3a:83:b4:9e:89:26:d3:7f:84:17:26:36
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Chains
Jan 25, 2010
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Serial Number
5e:6d:dc:87:37:50:82:84:58:14:f4:42:d1:d8:2a:25
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 15, 2007 - Jun 11, 2010
Minor OS version
0
Major OS version
6
Entry point
938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntoskrnl.exe
ZwReadFile
ZwClose
ZwOpenFile
ZwQueryInformationFile
MmGetSystemRoutineAddress
PsGetVersion
PsSetLoadImageNotifyRoutine
KdDebuggerEnabled
InitSafeBootMode
ExAllocatePool
IoCreateDevice
RtlDeleteElementGenericTable
KeGetCurrentThread
RtlLookupElementGenericTable
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlUpcaseUnicodeChar
ZwAllocateVirtualMemory
RtlInitUnicodeString
IoRegisterDriverReinitialization
IofCompleteRequest
ExFreePoolWithTag
ZwQueryValueKey
ZwOpenKey
KeUnstackDetachProcess
KeStackAttachProcess
_stricmp
ZwQuerySystemInformation
ZwQueryInformationProcess
ObOpenObjectByPointer
PsLookupProcessByProcessId
ObfDereferenceObject
_except_handler3
memcpy
memset
hal
KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
896B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
768B
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=39, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
signed drivers/63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802
- IMPHASH 427f21f7b15d0f59b37297ba1e38c286
- SHA256 63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802
- MD5 1e17d81979271cfa44d471430fe123a5
- SHA1 e22b0d0b6d71c50bcd83e5da0b227371b142a386
- SHA512 12374ba4080b7b287010338a31e3d686df7f631ec62073ee9b64ed8a349ca0087a32c3287d713952cc41c276ce64b9d029e52685e74027b1e5abd1efb2e38e33
- SSDEEP 384:KMOM1RJyWzUIl+FQazFlXlHLguhg0TzQ3Tv22lu/IlIT5th851M6jWfbCC:KMv1RFUIiQExg0nQ3y2k/BnhUMmQbCC
- TLSH T1B3B28ED359C254F7DC9A1AB0C9AA8751E87AF4312D6FCE574B54488E1F227C0FB2424B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
8a:8e:0a:73:85:b6:15:d7:f8:66:37:1d:e8:5b:7d:1f:d7:f6:0c:98
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=JMicron Technology Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=System Design,O=JMicron Technology Corp.,L=Hsinchu,ST=Taiwan,C=TW
Chains
Nov 6, 2026
CN=JMicron Technology Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=System Design,O=JMicron Technology Corp.,L=Hsinchu,ST=Taiwan,C=TW
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=JMicron Technology Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=System Design,O=JMicron Technology Corp.,L=Hsinchu,ST=Taiwan,C=TW
Serial Number
47:6f:49:f4:c9:59:f6:56:e9:aa:1e:b8:7f:c5:29:bb
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 18, 2009 - Jul 25, 2012
Minor OS version
0
Major OS version
6
Entry point
938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntoskrnl.exe
ZwReadFile
ZwClose
ZwOpenFile
ZwQueryInformationFile
PsGetVersion
_stricmp
ZwQuerySystemInformation
PsSetLoadImageNotifyRoutine
KdDebuggerEnabled
ExAllocatePool
IofCompleteRequest
IoCreateDevice
RtlDeleteElementGenericTable
KeGetCurrentThread
RtlLookupElementGenericTable
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlUpcaseUnicodeChar
ZwAllocateVirtualMemory
RtlInitUnicodeString
IoRegisterDriverReinitialization
InitSafeBootMode
ExFreePoolWithTag
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
ZwQueryValueKey
ZwOpenKey
KeUnstackDetachProcess
KeStackAttachProcess
ZwQueryInformationProcess
ObOpenObjectByPointer
PsLookupProcessByProcessId
ObfDereferenceObject
memcpy
memset
_except_handler3
hal
KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
896B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
896B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
768B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=41, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
signed drivers/70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b
- IMPHASH be2c3036d981fa5ac54d71ba4ce15c7d
- SHA256 70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b
- MD5 37fc7c5d89f1e5a96f54318df1a2b905
- SHA1 c81e8e4af351161519c3a30db103aa2fd2abbf29
- SHA512 c0f0a22c2b320015f4d61d552231ec6a94e1636bfd3634d85bcac2960b0b9c2ea99a3d78cfd2dd99c65fc9b89b9f7bd5242081729518c34a12cbf59d630ee23c
- SSDEEP 384:3pjc0UYZy1Ttvyph2adBRd64h+Erl2zB5ls7O7hBWnqTYJLWd6jqdybz:3p4U0Lm2aKF56iBOLAmIybz
- TLSH T15CB27B6787052061D9861D70B2EADE67AA3EF3150BC440C3D62609552FA27F97B3D24B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Stuxnet
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
fd:9a:d5:8c:fa:ca:7a:02:4a:6c:1c:9a:db:b4:c9:97:ed:6c:4e:92
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Chains
Feb 3, 2010
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW
Serial Number
5e:6d:dc:87:37:50:82:84:58:14:f4:42:d1:d8:2a:25
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 15, 2007 - Jun 11, 2010
Minor OS version
0
Major OS version
5
Entry point
7712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
psapi
EnumProcessModules
GetModuleBaseNameW
kernel32
GetFileSize
GetFileAttributesExW
RtlUnwind
GetModuleHandleW
SetFileTime
WriteFile
GetFileAttributesW
CreateFileW
lstrlenW
GetProcAddress
CloseHandle
DeleteFileW
lstrcpyW
SetFileAttributesW
GetCurrentProcess
SetLastError
lstrcmpiW
GetCurrentThreadId
GetCurrentProcessId
lstrcmpA
IsBadReadPtr
GetModuleFileNameW
lstrcmpiA
GetModuleHandleA
VirtualProtect
lstrcatW
VirtualFree
lstrcpynW
ReadFile
VirtualAlloc
CreateMutexW
SetErrorMode
FreeLibrary
HeapAlloc
WaitForSingleObject
GetTickCount
GetProcessHeap
Sleep
GetLastError
DisableThreadLibraryCalls
ReleaseMutex
CreateThread
SetFilePointer
user32
GetWindowThreadProcessId
SendMessageW
IsWindowVisible
EnumChildWindows
GetClassNameW
EnumWindows
PostMessageW
wsprintfW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
902B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=1, productName=Unmarked objects,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=6, id=14, version=7299,
count=10, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,