hello-1-Redhat - MsSignTool.efi

info
MZ
PE
foremost
signature
hexdump
disasm
log
discuss
donate

filename	hello-1-Redhat - MsSignTool.efi
size	7440 (0x1d10)
md5	0911387419c659781def67cbd9296b0f

type	PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x4fe8bc20
PointerToSymbolTable	0x1600
NumberOfSymbols	0x12
SizeOfOptionalHeader	0xf0
Characteristics	0x206
Magic	0x20b
LinkerVersion	2.22
SizeOfCode	0xa00
SizeOfInitializedData	0x800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2000
BaseOfCode	0x2000
ImageBase	0
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	0.0
ImageVersion	0.0
SubsystemVersion	0.0
Reserved1	0
SizeOfImage	0x7000
SizeOfHeaders	0x400
CheckSum	0x10664
Subsystem	0xa
DllCharacteristics	0
SizeOfStackReserve	0
SizeOfStackCommit	0
SizeOfHeapReserve	0
SizeOfHeapCommit	0
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x2000	0x81d	0xa00	R-X CODE
.reloc	0x3000	0xa	0x200	R-- IDATA DISCARDABLE
.data	0x4000	0x6c	0x200	RW- IDATA
.dynamic	0x5000	0xc0	0x200	RW- IDATA
.dynsym	0x6000	0x1b0	0x200	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0	0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0x17d8	0x538
BASERELOC	0x3000	0xa
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /CN=PkRoot

serial: 49BCE93144D207AA4B35A16915900043

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:bc:e9:31:44:d2:07:aa:4b:35:a1:69:15:90:00:43
        Signature Algorithm: sha1WithRSA
        Issuer: CN=PkRoot
        Validity
            Not Before: Apr 30 18:21:02 2012 GMT
            Not After : Dec 31 23:59:59 2039 GMT
        Subject: CN=KekRoot
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ab:0c:c1:1d:0a:a2:1f:9e:4f:9d:8d:25:ac:a6:
                    7d:18:cc:4a:80:8e:25:c0:6b:9c:07:e4:95:74:b1:
                    c3:c7:59:49:7f:d7:c7:10:84:1e:3c:89:4e:18:ba:
                    6e:2e:86:58:33:1b:85:93:05:18:27:2a:4a:bb:55:
                    f7:e2:de:64:56:f3:24:e1:e6:ed:0f:29:b8:b6:47:
                    71:c4:8b:c7:3f:34:c3:a3:be:81:85:70:4b:44:e3:
                    03:7a:31:71:7d:00:b7:6f:1a:ee:93:29:d3:34:b9:
                    a0:e2:3a:c5:2f:5f:e8:3e:76:f2:d6:50:c6:65:50:
                    12:c6:fa:ea:55:1f:52:ee:e5:fc:38:f4:59:4d:08:
                    e5:b6:69:52:ad:fb:56:7e:bb:9d:d4:f8:26:f2:ad:
                    ee:af:7a:7a:39:8a:57:b4:2b:17:f7:39:f6:b2:46:
                    a2:1d:9e:f9:dd:fb:01:d6:3f:c0:00:e1:b4:ae:e6:
                    4a:3e:8d:c5:ca:4a:4e:ee:13:e8:6b:00:6d:9d:af:
                    64:b6:41:b0:c4:e5:e6:65:5d:89:d6:54:5d:a5:78:
                    01:d4:72:04:af:1a:e7:7f:a8:df:c2:1d:85:e7:07:
                    71:1a:53:c9:80:e0:86:a8:da:6a:f3:e9:f0:6e:fc:
                    99:92:e3:ad:48:aa:ff:75:15:db:08:34:b5:15:4a:
                    2d:21
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            2.5.29.1: 
                09...ZS?..'..u.m...T..0.1.0..U....PkRoot......(...Ds.<..M.
    Signature Algorithm: sha1WithRSA
         9a:bc:b7:6d:32:8e:f0:7d:0a:42:16:6c:ce:02:8d:10:c8:d1:
         0b:48:7b:a1:5a:07:87:70:69:52:3d:1b:68:33:0c:12:12:53:
         f2:ad:1d:e2:03:2c:e8:55:d8:83:66:fb:d5:03:22:ac:05:d7:
         c7:b2:f4:ea:c8:33:c6:01:89:df:6e:b2:dc:59:1e:d4:ba:6b:
         31:eb:ea:c9:78:f4:6e:ad:fa:4d:f9:94:66:c6:f4:3c:65:b4:
         ee:0a:96:8d:14:33:6d:5b:df:54:38:e6:fb:db:d0:d5:4b:2a:
         65:f4:e8:d3:24:93:3a:3d:ee:06:40:df:3d:5b:e7:ce:ad:9e:
         4b:25:7e:01:cb:49:12:02:bd:1f:60:b6:59:55:97:dc:a4:8b:
         b2:6d:04:6c:79:e5:32:6c:74:13:27:fc:b5:99:3c:f2:bd:a1:
         e3:db:e1:f4:41:ac:c0:c2:ee:02:11:c8:d3:7d:cb:7a:1c:4d:
         ae:95:77:74:57:44:11:31:0a:71:f6:cd:43:23:15:b7:76:6a:
         81:3d:57:f6:44:97:fc:69:b1:a9:2a:d1:e7:b6:48:31:0b:ce:
         fb:91:06:ec:47:a9:99:cd:82:47:17:e3:96:de:c2:8f:cf:65:
         ca:b8:f4:06:06:ca:c5:7e:43:c6:a9:fc:f6:e4:cd:a5:cb:4a:
         cf:3d:0a:1f

pkcs7-signedData

SHA256: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15
- :

SHA256

77 f4 7f 49 a0 de 6d 41 31 0a 81 3a c1 04 ed 9d |w..I..mA1..:....| 3b d5 62 ed f3 1f b7 f7 68 5a 36 29 bb 28 b6 4c |;.b.....hZ6).(.L|

#2
- 2
  - 49:BC:E9:31:44:D2:07:AA:4B:35:A1:69:15:90:00:43
  - RSA-SHA1-2: nil
  - CN: PkRoot
  - 2012-04-30 18:21:02 UTC: 2039-12-31 23:59:59 UTC
  - CN: KekRoot
  - #5
    - rsaEncryption: nil
    - AB:0C:C1:1D:0A:A2:1F:9E:4F:9D:8D:25:AC:A6:7D:18:
      CC:4A:80:8E:25:C0:6B:9C:07:E4:95:74:B1:C3:C7:59:
      49:7F:D7:C7:10:84:1E:3C:89:4E:18:BA:6E:2E:86:58:
      33:1B:85:93:05:18:27:2A:4A:BB:55:F7:E2:DE:64:56:
      F3:24:E1:E6:ED:0F:29:B8:B6:47:71:C4:8B:C7:3F:34:
      C3:A3:BE:81:85:70:4B:44:E3:03:7A:31:71:7D:00:B7:
      6F:1A:EE:93:29:D3:34:B9:A0:E2:3A:C5:2F:5F:E8:3E:
      76:F2:D6:50:C6:65:50:12:C6:FA:EA:55:1F:52:EE:E5:
      FC:38:F4:59:4D:08:E5:B6:69:52:AD:FB:56:7E:BB:9D:
      D4:F8:26:F2:AD:EE:AF:7A:7A:39:8A:57:B4:2B:17:F7:
      39:F6:B2:46:A2:1D:9E:F9:DD:FB:01:D6:3F:C0:00:E1:
      B4:AE:E6:4A:3E:8D:C5:CA:4A:4E:EE:13:E8:6B:00:6D:
      9D:AF:64:B6:41:B0:C4:E5:E6:65:5D:89:D6:54:5D:A5:
      78:01:D4:72:04:AF:1A:E7:7F:A8:DF:C2:1D:85:E7:07:
      71:1A:53:C9:80:E0:86:A8:DA:6A:F3:E9:F0:6E:FC:99:
      92:E3:AD:48:AA:FF:75:15:DB:08:34:B5:15:4A:2D:21: 0x010001
  - 2.5.29.1
    - 86 5a 53 3f 86 2e 27 94 9d 75 b2 6d 96 b7 8d 54 |.ZS?..'..u.m...T|
      - CN: PkRoot
      - aa b9 ec f6 28 f6 ff aa 44 73 cf 3c e5 11 4d fe |....(...Ds.<..M.|
- RSA-SHA1-2:
```
9a bc b7 6d 32 8e f0 7d  0a 42 16 6c ce 02 8d 10  |...m2..}.B.l....|
c8 d1 0b 48 7b a1 5a 07  87 70 69 52 3d 1b 68 33  |...H{.Z..piR=.h3|
0c 12 12 53 f2 ad 1d e2  03 2c e8 55 d8 83 66 fb  |...S.....,.U..f.|
d5 03 22 ac 05 d7 c7 b2  f4 ea c8 33 c6 01 89 df  |.."........3....|
6e b2 dc 59 1e d4 ba 6b  31 eb ea c9 78 f4 6e ad  |n..Y...k1...x.n.|
fa 4d f9 94 66 c6 f4 3c  65 b4 ee 0a 96 8d 14 33  |.M..f..
```

#0
- CN: PkRoot
- 49:BC:E9:31:44:D2:07:AA:4B:35:A1:69:15:90:00:43
SHA256: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4

messageDigest:

1a 1c 66 c1 29 bd d1 90  3c 5c f3 51 88 6d da 7a  |..f.)...<\.Q.m.z|
41 40 f6 00 c8 5c a5 93  cf b0 d6 48 c4 0a a8 59  |A@...\.....H...Y|

rsaEncryption:

29 c7 43 4c 1a 80 e7 08  d5 b9 1b 63 93 d6 d5 b5  |).CL.......c....|
c3 f9 52 1b b8 39 14 75  b2 9c a3 fd c9 ce aa 85  |..R..9.u........|
3d 21 10 4c d1 8d 3b 1b  11 4f 51 23 9f 25 5e da  |=!.L..;..OQ#.%^.|
7b 1c 9f 1f 88 59 da d9  4a 9f 22 40 c9 72 85 45  |{....Y..J."@.r.E|
aa ad 6b 07 55 89 5f 37  f2 48 ed 08 87 34 78 c0  |..k.U._7.H...4x.|
c3 bc 68 f5 b0 16 97 bf  3c 55 0b fb e0 cc 3a c3  |..h.....

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1856	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK