home

xspirit.sys

Wellbia.com Co., Ltd.

It runs as a Windows kernel mode device driver named “xspirit”.
Publisher:
Wellbia.com Co., Ltd.  (signed and verified)

MD5:
dc9b416d34d6d93690a158ac92cbfe43

SHA-1:
47673b0b01018d060975732e8018b369bc7da6e0

SHA-256:
56aeecea27ce9feb55ea6b924f7cc8d3d9559734e85c773182a26019ade334a9

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/19/2024 11:12:24 AM UTC  (today)

File size:
71.6 KB (73,360 bytes)

File type:
Driver (Win32 SYS)

Common path:
C:\windows\xspirit.sys

Digital Signature
Signed by:
Wellbia.com Co., Ltd.

Authority:
Symantec Corporation

Valid from:
8/19/2016 7:00:00 AM

Valid to:
8/20/2019 6:59:59 AM

Subject:
CN="Wellbia.com Co., Ltd.", O="Wellbia.com Co., Ltd.", L=Guro-gu, S=Seoul, C=KR, SERIALNUMBER=113-86-08016, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=KR

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
192CC8C754C13C738A027688C6676E7C

File PE Metadata
Compilation timestamp:
10/18/2016 9:34:43 PM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
192:b1WJYAFSamsYbg9iBZQB3V6ycwjTy1LE+dXuKFX7j0R6t7+iaXhjtlA5mbF:ZWmAFSamsWsIycwALE+NuKGRKKBRU5mZ

Entry address:
0xFDBE

Entry point:
8B, FF, 55, 8B, EC, E8, BD, FF, FF, FF, 5D, E9, AE, 07, FF, FF, CC, CC, 38, FE, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, B2, 00, 01, 00, 98, 1D, 00, 00, 20, FE, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, FC, 00, 01, 00, 80, 1D, 00, 00, 30, FE, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 18, 01, 01, 00, 90, 1D, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, E8, 00, 01, 00, D4, 00, 01, 00, C0, 00, 01, 00, 00, 00, 00, 00, 04, 01, 01, 00, 00, 00, 00, 00, 1E, FF, 00, 00, 36, FF...
 
[+]

Entropy:
2.1099

Code size:
7.3 KB (7,424 bytes)

Driver
Display name:
xspirit

Type:
Kernel device driver (KernelDriver)


Scan xspirit.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.