DriverDoc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DriverDoc.exe
Size

2.4MB
MD5

046017d1ccfe50afadb65831220072f3
SHA1

08f1023b366b6d05276ff74e41a36deb84a54460
SHA256

b2f2341b447a9f6dbc835c8b07015ee1a18c41abf0f93a2b354f6c245808a39c
SHA512

4d1d2fbee5bc83b73d62fbe4b4384d84245816e608c5012d77caad7bff20626667d2e84dbd8cf991c16e7e6734ee798cb8c669ac2604d76bdc1df8c66ae973a0
SSDEEP

24576:jFV0CeT0o6QfhXlf4P35FLPOY5s2cv+AtdKEUuAaFo1Em7BpU8qUjDS2b:jFI0SIrOYq2c7vAYo1Em7vU8t

Score

N/A

Malware Config

Signatures

Files

DriverDoc.exe
.exe windows x86

Password: infected

ad5c3b8ccd7fb561a4c93d797ac9c37b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

ws2_32

ntohl

version

VerQueryValueW

user32

GetDC

oleaut32

VariantInit

advapi32

RegSaveKeyW

msvcrt

memcpy

winhttp

WinHttpOpen

wintrust

CryptCATOpen

sqlite3

sqlite3_free

wlanapi

WlanScan

shfolder

SHGetFolderPathW

crypt32

CryptSIPLoad

wsock32

inet_ntoa

gdi32

Pie

winmm

PlaySoundW

wininet

InternetOpenW

winspool.drv

ClosePrinter

comctl32

ImageList_Add

shell32

ShellExecuteW

crtdll

isspace

imagehlp

ImageRvaToVa

srclient

SRRemoveRestorePoint

ole32

OleDraw

iphlpapi

IcmpSendEcho

ntdll

RtlGetNtVersionNumbers

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.MPRESS1
Size: 1.2MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

ad5c3b8ccd7fb561a4c93d797ac9c37b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

version

user32

oleaut32

advapi32

msvcrt

winhttp

wintrust

sqlite3

wlanapi

shfolder

crypt32

wsock32

gdi32

winmm

wininet

winspool.drv

comctl32

shell32

crtdll

imagehlp

srclient

ole32

iphlpapi

ntdll

Exports

Exports

Sections

.MPRESS1 Size: 1.2MB - Virtual size: 6.9MB

.MPRESS2 Size: 5KB - Virtual size: 4KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.MPRESS1
Size: 1.2MB - Virtual size: 6.9MB

.MPRESS2
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB