DriverLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DriverLoader.exe
Size

291KB
MD5

2762291dd167d04f11bc2430a8e2d5d4
SHA1

81dc36822538ef8f5518fcbe208be96e8413df01
SHA256

b65ec9998c62c3a526696a711185d01bd29d8005939531c9825391f7f440fba1
SHA512

fc5ec2964c520f6ba952c3f54f881cec80c43ecd7d4e98452ec44a0893805612b238d6624e1dec6f106dc9ebd20a04d64abdd4bbc23ea15c902fdb3b5b789434
SSDEEP

3072:8+DrbNjFSQr60s/1FeSgRoD3MDclktSTb//QWYPfCrnw30mt+PvCDNUOLU+ecDjg:8+3Rq0s/gRgx4fC+2vCzScDEs

Score

N/A

Malware Config

Signatures

Files

DriverLoader.exe
.exe windows x86

a5ffb5fa3f690bf788096aaac1585c2f

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:58:9a:07:4b:46:a1:c3:5d:17:4e:1b:e7:a9:62:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/03/2006, 00:00

Not After

12/03/2009, 23:59

Subject

CN=Silicon Laboratories,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=MCU,O=Silicon Laboratories,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:6b:8e:bc:87:48:f9:cd:f8:d8:11:ef:f4:15:5a:90:87:0f:28:6e
Signer

Actual PE Digest

65:6b:8e:bc:87:48:f9:cd:f8:d8:11:ef:f4:15:5a:90:87:0f:28:6e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Silicon Laboratories,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=MCU,O=Silicon Laboratories,L=Austin,ST=Texas,C=US

06/10/2022, 18:35
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiClassNameFromGuidExA
SetupDiBuildClassInfoListExA
SetupDiDestroyDeviceInfoList
SetupGetLineTextA
SetupGetInfFileListA
SetupPromptReboot
SetupOpenInfFileA
SetupFindFirstLineA
SetupGetStringFieldA
SetupCloseInfFile
SetupDiSetDeviceInstallParamsA
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoA
SetupDiGetDriverInfoDetailA
SetupDiGetDriverInstallParamsA
SetupDiDestroyDriverInfoList
CM_Get_First_Log_Conf_Ex
CM_Free_Log_Conf_Handle
CM_Get_Next_Res_Des_Ex
CM_Free_Res_Des_Handle
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
SetupDiCreateDeviceInfoListExA
SetupDiOpenDeviceInfoA
SetupDiGetDeviceRegistryPropertyA
SetupCopyOEMInfA
CM_Get_DevNode_Status_Ex
SetupDiOpenClassRegKeyExA
CM_Connect_MachineA
CM_Locate_DevNode_ExA
CM_Reenumerate_DevNode_Ex
CM_Disconnect_Machine
SetupDiEnumDeviceInfo
SetupDiGetClassDevsExA
SetupDiClassGuidsFromNameExA
SetupDiGetDeviceInstallParamsA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiSetDeviceRegistryPropertyA
SetupDiCreateDeviceInfoA
SetupDiCreateDeviceInfoList
SetupDiGetINFClassA
CM_Get_Device_ID_ExA
SetupDiGetDeviceInfoListDetailA
SetupDiGetClassDescriptionExA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
strstr
atoi
malloc
free
_mbscmp
__CxxFrameHandler
_mbsnbicmp
_ismbcalpha
_mbctoupper
_mbctolower
_mbschr
??2@YAPAXI@Z
??3@YAXPAX@Z
printf
_mbsicmp
_iob
fputs
_setmbcp

mfc42

ord3798
ord3318
ord5442
ord6010
ord2763
ord5710
ord1158
ord6197
ord2302
ord567
ord3567
ord3402
ord5290
ord1776
ord6055
ord3790
ord6153
ord2915
ord5572
ord939
ord941
ord6385
ord2086
ord1669
ord2652
ord602
ord2642
ord470
ord755
ord2379
ord940
ord2764
ord4204
ord2818
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord641
ord2514
ord800
ord858
ord4278
ord6282
ord6283
ord537
ord2621
ord5265
ord4376
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord1576
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord860
ord1146
ord1168
ord540
ord324
ord2370
ord4234
ord4853
ord6334
ord926
ord6199
ord922
ord3874
ord6215
ord3092
ord665
ord1979
ord5186
ord354
ord535
ord924
ord4129
ord5683
ord4224
ord4710

kernel32

FindResourceA
GetStartupInfoA
GetModuleHandleA
CreateProcessA
WaitForSingleObject
DeleteFileA
CopyFileA
CreateDirectoryA
GetLastError
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
SetCurrentDirectoryA
GetSystemDirectoryA
GetVersionExA
FileTimeToSystemTime
GetDateFormatA
GetCurrentProcess
CloseHandle
FormatMessageA
LocalFree
GetWindowsDirectoryA
FindFirstFileA
FindNextFileA
FindClose
lstrlenA
GetFullPathNameA
GetFileAttributesA
LoadLibraryA
GetProcAddress
FreeLibrary

user32

IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
EnableWindow
LoadIconA
CharNextA
CharPrevA
LoadStringA
GetWindowRect
UpdateWindow
SendMessageA
InvalidateRect

advapi32

AdjustTokenPrivileges
RegDeleteKeyA
RegCreateKeyA
RegOpenKeyA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
RegDeleteValueA
InitiateSystemShutdownExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegSetValueExA
RegCloseKey

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc

ole32

CLSIDFromString

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5ffb5fa3f690bf788096aaac1585c2f

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

08:58:9a:07:4b:46:a1:c3:5d:17:4e:1b:e7:a9:62:9dCertificate

Extended Key Usages

Key Usages

65:6b:8e:bc:87:48:f9:cd:f8:d8:11:ef:f4:15:5a:90:87:0f:28:6eSigner

Signature Validations

Verification

06/10/2022, 18:35 Valid: false

Headers

File Characteristics

Imports

setupapi

version

msvcrt

mfc42

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 8KB - Virtual size: 5KB

.rsrc Size: 216KB - Virtual size: 213KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

08:58:9a:07:4b:46:a1:c3:5d:17:4e:1b:e7:a9:62:9d
Certificate

65:6b:8e:bc:87:48:f9:cd:f8:d8:11:ef:f4:15:5a:90:87:0f:28:6e
Signer

06/10/2022, 18:35
Valid: false

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 216KB - Virtual size: 213KB