hdwwiz[.]exe | Triage

General

Target

hdwwiz.exe
Size

64KB
MD5

a83f19002c3bb7565cea38eeb39bcbc7
SHA1

e5d510b7998332db98a2e20bc64ec9347ccc2d9d
SHA256

6bc2793cf2f9f678f5a9883ecc1e7f23a0f804932ab07663bf4e67f0e0e3ca72
SHA512

2ebc9dd804ede0f4f8b605fe8829958b334fd6b446a3e164a56a41c4bb8aaec2fd303dd5dc4bbbb7cb90ce7698d31008996ae5e73f8f17632031bc2ec0964806
SSDEEP

768:TDwl5wICn6m2jA4G0In3BhzhWM1GOVz171:vwbwI/jqZ3qOT5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hdwwiz.exe

Files

hdwwiz.exe
.exe windows:10 windows x86 arch:x86

613877cb92ef7df19bf5defd1ba60402

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

HdwWiz.pdb

Imports

kernel32

ExitProcess
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
GetProcAddress
LoadLibraryW
GetLastError
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CreateEventW
WaitForSingleObjectEx
CloseHandle
SetEvent
ExpandEnvironmentStringsW
SetLastError
GetSystemWindowsDirectoryW
RaiseException
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW

msvcrt

_except_handler4_common
_controlfp
?terminate@@YAXXZ
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_resetstkoflw
wcschr
wcsrchr
memcpy

ntdll

RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
NtClose
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
RtlNtStatusToDosError

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

613877cb92ef7df19bf5defd1ba60402

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

ntdll

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1004B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 1024B - Virtual size: 612B

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1004B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 1024B - Virtual size: 612B