driverquery[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

driverquery.exe
Size

81KB
MD5

f318244f614c2beca454040feda82f9c
SHA1

c1117e1fb6d489c210c464af6e92c5727a96f7ee
SHA256

0b9af0395fe2e9f5acfca6945f9f678fa4453f179e6a0e7dc32a259120366a01
SHA512

a239ee63ced77f5afe705b68538049037b5987342792055a5366222c08c9588dc8fa358626f761da6675868274fa8968da1617a336c61f75c538561accd38fab
SSDEEP

1536:+7sJFSTkPn9CDgQAVxk4T7tbULMnjuxlQVWtrs/bM4A4kDID55dxyY:3FS4nkebjjAlQCI/bD5/xv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
driverquery.exe

Files

driverquery.exe
.exe windows:6 windows x64

4f1fc4cb8d3f45b155b33cfa86571109

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetNumberFormatW
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetUserDefaultLocaleName
LocaleNameToLCID
GetUserDefaultLCID
FormatMessageW
LocalAlloc
WriteConsoleW
GetStdHandle
GetModuleFileNameW
FileTimeToSystemTime
GetComputerNameExW
HeapSize
HeapReAlloc
HeapAlloc
HeapValidate
HeapFree
CreateMutexW
ReadConsoleW
ReadFile
SetConsoleMode
MultiByteToWideChar
ExitProcess
CompareStringA
GetThreadLocale
CompareStringW
lstrlenA
GetConsoleMode
GetFileType
WideCharToMultiByte
SetThreadUILanguage
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
lstrlenW
GetLastError
SetLastError
GetConsoleOutputCP
GetProcessHeap

msvcrt

_XcptFilter
memcpy
__CxxFrameHandler3
_CxxThrowException
fflush
fprintf
__iob_func
_get_osfhandle
_fileno
wcstoul
wcstol
wcstod
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
memset
wcschr
_vsnwprintf
_wcsicmp
_wtoi
localtime
_stricmp
_strnicmp
_wcsnset
wcstok
_ltow
swprintf_s
_wsetlocale
_iob
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_memicmp
_errno

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
VerSetConditionMask
RtlVerifyVersionInfo
RtlCaptureContext

user32

LoadStringW
CharUpperW
wsprintfW

mpr

WNetGetLastErrorW
WNetAddConnection2W
WNetCancelConnection2W

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantInit
VariantClear
SysStringLen
VariantCopy
VariantChangeType
SysFreeString
SysAllocString
SysAllocStringByteLen

framedynos

?Left@CHString@@QEBA?AV1@H@Z
?FindOneOf@CHString@@QEBAHPEBG@Z
?Format@CHString@@QEAAXPEBGZZ
?GetBufferSetLength@CHString@@QEAAPEAGH@Z
?Find@CHString@@QEBAHG@Z
?Mid@CHString@@QEBA?AV1@H@Z
?Compare@CHString@@QEBAHPEBG@Z
??4CHString@@QEAAAEBV0@AEBV0@@Z
??0CHString@@QEAA@XZ
?ReleaseBuffer@CHString@@QEAAXH@Z
?GetBuffer@CHString@@QEAAPEAGH@Z
??4CHString@@QEAAAEBV0@PEBG@Z
??0CHString@@QEAA@PEBG@Z
?GetData@CHString@@IEBAPEAUCHStringData@@XZ
??1CHString@@QEAA@XZ

shlwapi

StrStrIW
StrCmpNW
StrChrW
StrChrIW
StrStrW

secur32

GetUserNameExW

ws2_32

WSAGetLastError
GetAddrInfoW
FreeAddrInfoW
GetNameInfoW
WSACleanup
WSAStartup

netapi32

NetApiBufferFree
NetServerGetInfo

version

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f1fc4cb8d3f45b155b33cfa86571109

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

user32

mpr

ole32

oleaut32

framedynos

shlwapi

secur32

ws2_32

netapi32

version

Sections

.text Size: 69KB - Virtual size: 68KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 52B

.text
Size: 69KB - Virtual size: 68KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 52B