hwperf[.]sys | Triage

Sharing

General

Target

hwperf.sys
Size

176KB
MD5

18b9c64aeee2a85d673de45870618f49
SHA1

fe1f40459f877ef88a466985be918efeb20ab2c2
SHA256

1f88462db4963c08b601cafe6cad809d3853ebad898bcd518f950096799b6270
SHA512

a12b608da1eba90638c1133af5b42fee03334c8cb9c676a9c689b2d93a0785a148332972a5532c8ab673ccf1b90bf3755fd5050412f184c0b834e58e5e560265
SSDEEP

3072:EepT2TbcnzzW44AIUxtS3NTQbg6bWJ2c8hZ+8iu7Ibf3a8Y0rRAXoLjHwSIisu29:EeubPJQb3+WZr0FYGzRIBNr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hwperf.sys

Files

hwperf.sys
.sys windows:10 windows x64 arch:x64

f73f24228894974aef90f517b5c53650

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

NtOpenFile
__chkstk
RtlInitUnicodeString
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlGetVersion
KeDelayExecutionThread

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE