home

xspirit.sys

Wellbia.com Co., Ltd.

It runs as a Windows kernel mode device driver named “xspirit”.
Publisher:
Wellbia.com Co., Ltd.  (signed and verified)

MD5:
ea8838fb623ca0bd11cff40e130b8839

SHA-1:
d56c803bf9685dae2b6783b0c8e62a48db5fd22e

SHA-256:
dac39e957f8ac3ca00ad5f18a64118eb2d78467b3f379fd2c6c35be8f63f3ea5

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/19/2024 11:01:49 AM UTC  (today)

File size:
71.6 KB (73,360 bytes)

File type:
Driver (Win32 SYS)

Common path:
C:\windows\xspirit.sys

Digital Signature
Signed by:
Wellbia.com Co., Ltd.

Authority:
Symantec Corporation

Valid from:
8/19/2016 3:00:00 AM

Valid to:
8/20/2019 2:59:59 AM

Subject:
CN="Wellbia.com Co., Ltd.", O="Wellbia.com Co., Ltd.", L=Guro-gu, S=Seoul, C=KR, SERIALNUMBER=113-86-08016, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=KR

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
192CC8C754C13C738A027688C6676E7C

File PE Metadata
Compilation timestamp:
11/5/2016 9:43:36 AM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
192:T1WJYAFSamsYbg9iBZQB3V6ycwjTy1LU2dXuKF97j0R6t7+iaXhjtlA5+0a:hWmAFSamsWsIycwALU2NuKQRKKBRU5+j

Entry address:
0xFDBE

Entry point:
8B, FF, 55, 8B, EC, E8, BD, FF, FF, FF, 5D, E9, AE, 07, FF, FF, CC, CC, 38, FE, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, B2, 00, 01, 00, 98, 1D, 00, 00, 20, FE, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, FC, 00, 01, 00, 80, 1D, 00, 00, 30, FE, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 18, 01, 01, 00, 90, 1D, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, E8, 00, 01, 00, D4, 00, 01, 00, C0, 00, 01, 00, 00, 00, 00, 00, 04, 01, 01, 00, 00, 00, 00, 00, 1E, FF, 00, 00, 36, FF...
 
[+]

Entropy:
2.1089

Code size:
7.3 KB (7,424 bytes)

Driver
Display name:
xspirit

Type:
Kernel device driver (KernelDriver)


Scan xspirit.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.