fusbhub.sys - Filter USB hub

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	fusbhub.sys
size	85568 (0x14e40)
md5	69094013a93adf5dec6932645ea805a5

type	PE32+ executable (native) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
1	0	72
257	23917	3
259	23917	4
260	23917	5
261	24215	23
255	24210	1
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	8
TimeDateStamp	0x586cb6d1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x11400
SizeOfInitializedData	0x2e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x17000
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x1a000
SizeOfHeaders	0x400
CheckSum	0x1a5ec
Subsystem	1
DllCharacteristics	0x160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x108aa	0x10a00	R-X CODE
.rdata	0x12000	0x150c	0x1600	R-- IDATA
.data	0x14000	0x1c8	0x200	RW- IDATA
.pdata	0x15000	0xd80	0xe00	R-- IDATA
.gfids	0x16000	4	0x200	R-- IDATA
INIT	0x17000	0x920	0xa00	R-X CODE DISCARDABLE
.rsrc	0x18000	0x378	0x400	R-- IDATA DISCARDABLE
.reloc	0x19000	0x150	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x17090	0x28
RESOURCE	0x18000	0x378
EXCEPTION	0x15000	0xd80
SECURITY	0x14600	0x840
BASERELOC	0x19000	0x150
DEBUG	0x12730	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x12770	0xd0
Bound_IAT	0	0
IAT	0x12000	0x240
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	788	0

module_name	hint	function_name
ntoskrnl.exe	2639	_vsnwprintf
ntoskrnl.exe	2645	_wcsnicmp
ntoskrnl.exe	1010	KeInitializeEvent
ntoskrnl.exe	1135	KeSetEvent
ntoskrnl.exe	1175	KeWaitForSingleObject
ntoskrnl.exe	148	ExAllocatePoolWithTag
ntoskrnl.exe	184	ExFreePoolWithTag
ntoskrnl.exe	603	IoBuildDeviceIoControlRequest
ntoskrnl.exe	605	IoBuildSynchronousFsdRequest
ntoskrnl.exe	900	IofCallDriver
ntoskrnl.exe	654	IoDeleteDevice
ntoskrnl.exe	657	IoDetachDevice
ntoskrnl.exe	683	IoGetAttachedDeviceReference
ntoskrnl.exe	696	IoGetDeviceProperty
ntoskrnl.exe	1471	ObfDereferenceObject
ntoskrnl.exe	2642	_wcsicmp
ntoskrnl.exe	1944	RtlInitUnicodeString
ntoskrnl.exe	1651	PsGetVersion
ntoskrnl.exe	901	IofCompleteRequest
ntoskrnl.exe	630	IoCreateDevice
ntoskrnl.exe	641	IoCreateSymbolicLink
ntoskrnl.exe	656	IoDeleteSymbolicLink
ntoskrnl.exe	786	IoReleaseCancelSpinLock
ntoskrnl.exe	733	IoInvalidateDeviceRelations
ntoskrnl.exe	2388	ZwClose
ntoskrnl.exe	2459	ZwOpenDirectoryObject
ntoskrnl.exe	2497	ZwQueryDirectoryObject
ntoskrnl.exe	1457	ObReferenceObjectByName
ntoskrnl.exe	2598	__C_specific_handler
ntoskrnl.exe	663	IoDriverObjectType
ntoskrnl.exe	2732	wcsstr
ntoskrnl.exe	2650	_wcsupr
ntoskrnl.exe	608	IoCancelIrp
ntoskrnl.exe	2159	RtlWriteRegistryValue
ntoskrnl.exe	1814	RtlCreateRegistryKey
ntoskrnl.exe	952	KeClearEvent
ntoskrnl.exe	589	IoAllocateIrp
ntoskrnl.exe	674	IoFreeIrp
ntoskrnl.exe	750	IoOpenDeviceRegistryKey
ntoskrnl.exe	1455	ObReferenceObjectByHandle
ntoskrnl.exe	1453	ObQueryNameString
ntoskrnl.exe	602	IoBuildAsynchronousFsdRequest
ntoskrnl.exe	962	KeDelayExecutionThread
ntoskrnl.exe	580	IoAcquireCancelSpinLock
ntoskrnl.exe	599	IoAttachDeviceToDeviceStack
ntoskrnl.exe	745	IoIsWdmVersionAvailable
ntoskrnl.exe	1486	PoCallDriver
ntoskrnl.exe	1554	PoStartNextPowerIrp
ntoskrnl.exe	2612	_purecall
ntoskrnl.exe	1018	KeInitializeSpinLock
ntoskrnl.exe	931	KeAcquireSpinLockRaiseToDpc
ntoskrnl.exe	1104	KeReleaseSpinLock
ntoskrnl.exe	1289	MmProbeAndLockPages
ntoskrnl.exe	1307	MmUnlockPages
ntoskrnl.exe	1271	MmMapLockedPagesSpecifyCache
ntoskrnl.exe	1309	MmUnmapLockedPages
ntoskrnl.exe	591	IoAllocateMdl
ntoskrnl.exe	675	IoFreeMdl
ntoskrnl.exe	176	ExEventObjectType
ntoskrnl.exe	218	ExQueryDepthSList
ntoskrnl.exe	311	ExpInterlockedPopEntrySList
ntoskrnl.exe	312	ExpInterlockedPushEntrySList
ntoskrnl.exe	195	ExInitializeNPagedLookasideList
ntoskrnl.exe	162	ExDeleteNPagedLookasideList
ntoskrnl.exe	196	ExInitializePagedLookasideList
ntoskrnl.exe	163	ExDeletePagedLookasideList
ntoskrnl.exe	1573	PsCreateSystemThread
ntoskrnl.exe	594	IoAllocateWorkItem
ntoskrnl.exe	678	IoFreeWorkItem
ntoskrnl.exe	762	IoQueueWorkItem
ntoskrnl.exe	946	KeBugCheckEx

StringTable 040904b0

CompanyName	ELTIMA Software
FileDescription	Filter USB hub
FileVersion	7.0.1221.0
InternalName	fusbhub.sys
LegalCopyright	Copyright ?ELTIMA Software 2000-2015
OriginalFilename	fusbhub.sys
ProductName	USB to Ethernet Connector
ProductVersion	7.0.1221.0

VS_FIXEDFILEINFO

FileVersion	7.0.1221.0
ProductVersion	7.0.1221.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	3
FileSubtype	1

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /CN=WDKTestCert seanxs,131275397155792305

serial: 696F4DADEAE6579D4095AF8FA84359B3

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:6f:4d:ad:ea:e6:57:9d:40:95:af:8f:a8:43:59:b3
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN=WDKTestCert seanxs,131275397155792305
        Validity
            Not Before: Dec 30 02:48:36 2016 GMT
            Not After : Dec 30 00:00:00 2026 GMT
        Subject: CN=WDKTestCert seanxs,131275397155792305
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c1:9f:d7:60:5b:45:98:b7:b1:85:68:ca:e9:7d:
                    bd:a4:87:fa:09:ae:11:5f:73:dc:0d:f1:8b:11:6f:
                    31:c9:f2:bb:e4:72:16:7d:14:1f:ee:a4:48:f8:26:
                    4d:73:20:c8:ef:3f:15:2f:d4:3f:37:e3:a8:79:47:
                    e8:db:ab:02:fd:51:1c:96:0f:90:54:ee:08:3a:32:
                    b5:5d:72:3f:4e:78:8b:28:95:2e:60:28:28:49:34:
                    45:e7:4b:13:bb:3e:69:bb:f1:59:2f:47:c7:df:22:
                    4a:d5:70:f6:16:94:37:83:26:c9:f5:a7:13:64:4a:
                    bd:b5:31:3a:f9:d7:7a:95:7a:97:32:a5:1d:ec:ba:
                    3c:a4:9f:de:db:0f:03:0b:be:fc:84:1c:df:f6:07:
                    7e:e5:de:a2:4f:53:37:c3:b4:c8:2c:d7:15:4d:a5:
                    66:e7:f5:eb:0e:8a:9f:b7:bb:3d:58:a9:90:b9:c9:
                    ec:a9:4c:bd:05:ab:b3:71:10:cf:5d:63:2d:d1:85:
                    33:6b:1d:f7:84:b0:21:7f:cf:94:b7:16:69:52:a7:
                    11:f2:4d:9b:63:43:e2:de:fb:89:d7:b1:8e:63:55:
                    34:19:ba:64:23:4d:60:af:61:b8:5b:2a:af:57:c6:
                    db:d6:aa:2e:d1:e0:88:76:ad:96:e4:73:c4:64:f5:
                    9b:57
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: 
                Key Encipherment, Data Encipherment
            X509v3 Extended Key Usage: 
                Code Signing
    Signature Algorithm: sha1WithRSAEncryption
         75:27:4d:30:3d:f4:1a:e2:98:d3:24:e7:41:e0:02:80:be:c3:
         e4:82:01:91:fd:b5:03:97:fb:af:0a:61:0a:7b:70:d0:3f:48:
         0b:4a:bc:c4:36:27:f5:06:cb:b7:8b:1b:7c:fe:8a:eb:6a:07:
         78:0c:71:fe:50:4a:fb:0a:b7:cf:d1:2e:77:81:d5:80:e0:87:
         cd:5a:a5:69:84:10:39:0f:4f:5b:e4:0d:3c:6c:aa:88:ca:70:
         29:c8:d0:4b:e1:01:8e:5b:d0:c6:89:43:4d:99:bf:32:79:e8:
         8c:74:b4:94:b8:5f:8c:b7:b1:7f:6c:a1:25:0c:67:fe:19:44:
         13:ae:3a:fd:34:42:b4:70:4b:b0:0a:3c:ac:b6:62:3d:5a:46:
         ef:39:ed:46:38:90:3c:1a:b2:1d:13:b0:03:4d:25:64:b6:e3:
         2d:c3:83:bc:02:ad:a8:68:4a:87:7e:bf:0d:b2:2d:8a:c4:82:
         8e:f7:29:00:44:79:c4:17:28:c5:75:ef:7c:4a:f6:cc:55:d7:
         ce:6b:a3:2f:fc:f1:eb:2a:63:88:45:f6:bc:a8:80:7e:2d:6a:
         98:c8:ba:f1:fd:59:d7:b0:e5:26:98:1c:9a:cf:53:26:fc:83:
         3f:c2:30:6f:a6:8c:29:64:f4:0c:60:75:80:cf:15:34:cb:2c:
         dd:c2:ff:29

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

a6 b5 86 d5 b4 a1 24 66 ae 05 a2 17 da 8e 60 d6 |......$f......`.|

1.3.6.1.4.1.311.2.3.1:

00 00 00 00 49 39 21 50  6f c9 97 e9 c4 cc 8f 13  |....I9!Po.......|
dc 4f 4a 7f 24 ba f8 56  00 04 00 00 bd 68 30 59  |.OJ.$..V.....h0Y|
38 3f 3d 28 a6 a8 dc ac  22 cd 27 ff bd a8 83 6a  |8?=(....".'....j|
00 14 00 00 ed 3f 60 ee  d6 ee bd ce b9 7b b8 60  |.....?`......{.`|
bf 2a 97 61 ab 64 7b 57  00 24 00 00 fd f3 08 03  |.*.a.d{W.$......|
cd fb 84 71 99 c8 ad fe  f6 e8 f9 86 f0 8e 50 91  |...q..........P.|
00 34 00 00 c8 94 6a f5  1c a8 02 ad 49 0d d5 4f  |.4....j.....I..O|
d5 18 f6 e0 8f 65 61 ce  00 44 00 00 f0 8c d6 12  |.....ea..D......|
47 0a 53 1d 31 1e 99 6f  70 7f d5 62 17 7a 6a 34  |G.S.1..op..b.zj4|
00 54 00 00 40 93 53 53  a6 ec 99 c4 62 69 cd 80  |.T..@.SS....bi..|
d8 00 af 3c 4f 88 a8 ba  00 64 00 00 c5 b8 df 9b  |...|.e}.<..D..w..{|
3a 19 e3 93 1b 4e 2e 87  f0 eb e5 11 02 6b 28 5c  |:....N.......k(\|
00 46 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |.F..............|
00 00 00 00 00 00 00 00                           |........        |

SHA1

14 40 81 63 c5 d3 99 e8 63 04 c9 68 90 74 1f 7a |.@.c....c..h.t.z| f5 f4 b1 4d |...M |

#2
- 2
  - 69:6F:4D:AD:EA:E6:57:9D:40:95:AF:8F:A8:43:59:B3
  - RSA-SHA1: nil
  - CN: WDKTestCert seanxs,131275397155792305
  - 2016-12-30 02:48:36 UTC: 2026-12-30 00:00:00 UTC
  - CN: WDKTestCert seanxs,131275397155792305
  - #5
    - rsaEncryption: nil
    - C1:9F:D7:60:5B:45:98:B7:B1:85:68:CA:E9:7D:BD:A4:
      87:FA:09:AE:11:5F:73:DC:0D:F1:8B:11:6F:31:C9:F2:
      BB:E4:72:16:7D:14:1F:EE:A4:48:F8:26:4D:73:20:C8:
      EF:3F:15:2F:D4:3F:37:E3:A8:79:47:E8:DB:AB:02:FD:
      51:1C:96:0F:90:54:EE:08:3A:32:B5:5D:72:3F:4E:78:
      8B:28:95:2E:60:28:28:49:34:45:E7:4B:13:BB:3E:69:
      BB:F1:59:2F:47:C7:DF:22:4A:D5:70:F6:16:94:37:83:
      26:C9:F5:A7:13:64:4A:BD:B5:31:3A:F9:D7:7A:95:7A:
      97:32:A5:1D:EC:BA:3C:A4:9F:DE:DB:0F:03:0B:BE:FC:
      84:1C:DF:F6:07:7E:E5:DE:A2:4F:53:37:C3:B4:C8:2C:
      D7:15:4D:A5:66:E7:F5:EB:0E:8A:9F:B7:BB:3D:58:A9:
      90:B9:C9:EC:A9:4C:BD:05:AB:B3:71:10:CF:5D:63:2D:
      D1:85:33:6B:1D:F7:84:B0:21:7F:CF:94:B7:16:69:52:
      A7:11:F2:4D:9B:63:43:E2:DE:FB:89:D7:B1:8E:63:55:
      34:19:BA:64:23:4D:60:AF:61:B8:5B:2A:AF:57:C6:DB:
      D6:AA:2E:D1:E0:88:76:AD:96:E4:73:C4:64:F5:9B:57: 0x010001
  - #6
    - keyUsage: 0
    - extendedKeyUsage: codeSigning
- RSA-SHA1:
```
75 27 4d 30 3d f4 1a e2  98 d3 24 e7 41 e0 02 80  |u'M0=.....$.A...|
be c3 e4 82 01 91 fd b5  03 97 fb af 0a 61 0a 7b  |.............a.{|
70 d0 3f 48 0b 4a bc c4  36 27 f5 06 cb b7 8b 1b  |p.?H.J..6'......|
7c fe 8a eb 6a 07 78 0c  71 fe 50 4a fb 0a b7 cf  ||...j.x.q.PJ....|
d1 2e 77 81 d5 80 e0 87  cd 5a a5 69 84 10 39 0f  |..w......Z.i..9.|
4f 5b e4 0d 3c 6c aa 88  ca 70 29 c8 d0 4b e1 01  |O[..
```

#0
- CN: WDKTestCert seanxs,131275397155792305
- 69:6F:4D:AD:EA:E6:57:9D:40:95:AF:8F:A8:43:59:B3
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

ac 77 0b d4 a2 f7 72 2e  f0 27 a1 00 cb e0 30 54  |.w....r..'....0T|
23 a2 cc 26                                       |#..&            |

rsaEncryption:

7d 52 5f 8a 78 07 e7 32  0d 35 af 2d e8 39 ed 59  |}R_.x..2.5.-.9.Y|
c1 e0 d6 2c 8c 18 69 f3  80 25 eb f3 ae 00 60 3c  |...,..i..%....`<|
88 7b 8e 28 71 e1 d6 ff  5c 32 b9 29 1e 8b d0 c1  |.{.(q...\2.)....|
a4 8f 3e b6 40 ff dc 97  b5 58 df fa 80 03 1b e4  |..>.@....X......|
52 ef a7 6d 53 df 93 5e  31 d7 c3 b3 f3 c9 b0 52  |R..mS..^1......R|
62 34 88 d1 62 c8 22 25  65 3b 99 7a cc 2e 1d 26  |b4..b."%e;.z...&|
81 8d 27 fa ab d6 45 c4  0a cc 76 71 a6 68 61 c1  |..'...E...vq.ha.|
13 49 1e a8 a8 c3 ac 76  17 32 b4 30 e1 0d 9b 95  |.I.....v.2.0....|
04 17 5d 80 ae c3 a2 7a  17 9e 38 36 da c5 c0 96  |..]....z..86....|
7e 5e e6 c7 17 19 3a 05  84 a6 8c 5d b1 0a 8b 7c  |~^....:....]...||
a4 11 f6 71 39 8e ea 8a  2d 26 6c 3b d4 61 fa ac  |...q9...-&l;.a..|
eb 85 15 92 78 63 ff d9  41 2f e3 75 2a f5 00 af  |....xc..A/.u*...|
ce c1 53 69 54 d3 e1 94  a2 1f bd d8 a4 d1 7c 13  |..SiT.........|.|
db a7 48 cc 7e c2 93 19  62 e9 cf 36 50 31 af 51  |..H.~...b..6P1.Q|
a0 90 3b 71 68 1a 3e dc  dd 5e 07 b9 a2 ba fc 55  |..;qh.>..^.....U|
5a bc f1 7a 6e ac ae cf  f2 a1 c9 f7 72 96 da 13  |Z..zn.......r...|