Static task
static1
Behavioral task
behavioral1
Sample
AmdPPM.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AmdPPM.exe
Resource
win10v2004-20230220-en
General
-
Target
04eccd8f67d64fd884065306eb102fdd504442cb248c27414717ea14235169a1
-
Size
27KB
-
MD5
667d002edb22065873c75d1557f84c43
-
SHA1
529b780fae2d26d7b9a5cf033dae4631b07d2eec
-
SHA256
04eccd8f67d64fd884065306eb102fdd504442cb248c27414717ea14235169a1
-
SHA512
f9560616a8d21f72f0158aee69e54c3f60d38d982bad02e0aed7094603468413fffc9ab43e5c286487e39b71d93e0e9c03bbeb10cc1944931d811fe0768d281b
-
SSDEEP
768:rRYXvyDVLatY4LmvEx50JhjFAAki85WJGcnsNQNZ:r28Ja646LDcHWJGcoQNZ
Malware Config
Signatures
Files
-
04eccd8f67d64fd884065306eb102fdd504442cb248c27414717ea14235169a1.zip
-
AmdPPM.sys.exe windows x86
2142972b7dbd48459807617fe4d892b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoFreeWorkItem
ZwPowerInformation
IoBuildSynchronousFsdRequest
KeSetEvent
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeQueryActiveProcessors
MmMapIoSpace
ZwClose
RtlEqualUnicodeString
ZwOpenKey
MmUnmapIoSpace
IoQueueWorkItem
IoAllocateWorkItem
RtlAnsiStringToUnicodeString
RtlInitAnsiString
READ_REGISTER_UCHAR
READ_REGISTER_USHORT
READ_REGISTER_ULONG
WRITE_REGISTER_UCHAR
WRITE_REGISTER_USHORT
WRITE_REGISTER_ULONG
RtlIntegerToUnicodeString
IoDeleteDevice
IoAttachDeviceToDeviceStack
PoSetPowerState
KeInitializeSpinLock
IoCreateDevice
ExUnregisterCallback
IofCompleteRequest
KefAcquireSpinLockAtDpcLevel
IoReleaseCancelSpinLock
KeClearEvent
KeNumberProcessors
ExRegisterCallback
ExCreateCallback
RtlCopyUnicodeString
IoWMIRegistrationControl
swprintf
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
PoCallDriver
PoStartNextPowerIrp
PoRequestPowerIrp
MmLockPagableDataSection
MmUnlockPagableImageSection
wcslen
RtlWriteRegistryValue
RtlQueryRegistryValues
RtlInitUnicodeString
ZwQueryValueKey
strncpy
KeInitializeEvent
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
IofCallDriver
KeWaitForSingleObject
_vsnwprintf
KeBugCheckEx
KeTickCount
IoDetachDevice
ExFreePoolWithTag
hal
KfReleaseSpinLock
KeQueryPerformanceCounter
READ_PORT_UCHAR
HalSetBusDataByOffset
KeStallExecutionProcessor
KfAcquireSpinLock
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT
READ_PORT_ULONG
READ_PORT_USHORT
wmilib.sys
WmiCompleteRequest
WmiSystemControl
WmiFireEvent
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
oem13.CAT
-
oem13.inf