General

  • Target

    KelvinL_BIOS_1.22.exe

  • Size

    4.6MB

  • MD5

    4d5aaa07e13417cf738f88936e8392ec

  • SHA1

    21727bdb9a451d3cdb2b58ca232a717fc87e97a0

  • SHA256

    c453418b0a11c3e142ec8b664bbef3660d9c226da9a395c82138c64f532865d2

  • SHA512

    5d1c10011968e061f07c552dcd4bb986d440d352d7393f460665aef561dde15f8cc59557e5160838158f16e516eea382091e9afebc698fa089e579ccc8046e96

  • SSDEEP

    98304:kd8E33aYl+ThZ1lPc7B7yg2rYEFoctuLD1sROsouS6t1:Hyl+ThZbMCFoyKDddit1

Score
3/10

Malware Config

Signatures

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • KelvinL_BIOS_1.22.exe
    .exe windows:4 windows x86 arch:x86

    aa1bddb976cc14514caf3362a94d13f7


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    4b45b7e00344a87332fbd12653854d1a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    0b75f1007d3cc8e457970ae3e3fd53c3


    Headers

    Imports

    Exports

    Sections

  • CapAgent.efi
    .dll windows:0 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • SysStateDriver.sys
    .sys windows:10 windows x64 arch:x64

    4c5464c95bec5f76a1761ebe1d91a794


    Code Sign

    Headers

    Imports

    Sections

  • UEFI_FW.bin
    .dll windows:0 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • WUExeAgent_1.0.0.18.exe
    .exe windows:6 windows x86 arch:x86

    9acb65ffa15c6b3c50e36126366c8177


    Code Sign

    Headers

    Imports

    Sections

  • bcdedit.exe
    .exe windows:10 windows x64 arch:x64

    5590a306d0fa939852b69e8411ca102b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • install-sys.cmd
  • msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    f2d585ff96afa3a77e09f5b37e7b3230


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis
  • uninstall-sys.cmd
  • vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    dbf59b100b5a77256457cf057352b441


    Code Sign

    Headers

    Imports

    Exports

    Sections