f9fba85de9d87f2f7cdc69dc1909f021ce94d637d9288886f86dc7d25e0535f2

Sharing

Copy URL Twitter E-mail

General

Target

f9fba85de9d87f2f7cdc69dc1909f021ce94d637d9288886f86dc7d25e0535f2
Size

2.0MB
MD5

fc47beefbeca7e8cbc63a9411dc52fc9
SHA1

4f91a580d7d9974d5cdbbcf381dd07305ae20fd3
SHA256

f9fba85de9d87f2f7cdc69dc1909f021ce94d637d9288886f86dc7d25e0535f2
SHA512

1f4e5fa7a09c5cf01279f88f24bcc6892c8fdd299e98c65bb5a3cff7b4c777b161ce394aa736579be390a3a89792bb0eefd5195cc7910bde084c6436b7b49f51
SSDEEP

12288:euKDDNyhwi2Tte3HPXeNDHloc5te3Jx63ri1Sq08hV0SBKcUpvBrvuYpk2UT+8x1:eLD8+i2Tte3HmscbqWcSUnK7d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9fba85de9d87f2f7cdc69dc1909f021ce94d637d9288886f86dc7d25e0535f2

Files

f9fba85de9d87f2f7cdc69dc1909f021ce94d637d9288886f86dc7d25e0535f2
.dll windows:6 windows x64 arch:x64

54a201438c53fa28c04525c59e5a2b58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\workarea\14.101.1003\drivers\hsa\runtimenew\src\services\build\wNow64a\B_rel\hsaservices64.pdb

Imports

newhsacore64

HsaAmdQueryTrace
HsaAmdStopTrace
HsaAmdStartTrace
HsaAmdReleaseTraceAccess
HsaAmdAcquireTraceAccess
HsaAmdUnregisterTrace
HsaAmdRegisterTrace
HsaAmdGetCounterProperties
HsaAmdCloseKfd
HsaAmdDestroyShaderEvent
HsaAmdSetShaderEvent
HsaAmdWaitShaderEvent
HsaAmdCreateShaderEvent
HsaAmdWatchDeviceAddress
HsaAmdControlKernelExecution
HsaAmdUnregisterDebuggerOnDevice
HsaAmdRegisterDebuggerOnDevice
HsaAmdRegisterCorePreDispatchCallback
HsaWritePM4Packet
HsaDestroyUserModeQueue
HsaCreateUserModeQueue
HsaSubmitAql
HsaGetDevices
HsaAmdFreeSystemMemory
HsaAmdAllocateSystemMemory

kernel32

GetLocaleInfoEx
CreateFileW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
Sleep
CloseHandle
RaiseException
GetLastError
QueryPerformanceCounter
SetEvent
WaitForSingleObject
CreateEventA
ExitProcess
SwitchToThread
GetCurrentThreadId
GetSystemTimeAsFileTime
CreateThreadpool
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryA
DebugBreak
LoadLibraryW
OutputDebugStringW
SetFilePointer
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
CompareStringEx
LoadLibraryExW
ReadConsoleW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
SetEndOfFile
MultiByteToWideChar
GetStringTypeW
IsProcessorFeaturePresent
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
HeapFree
HeapAlloc
HeapReAlloc
GetModuleHandleExW
AreFileApisANSI
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStdHandle
WriteFile
GetModuleFileNameW
HeapSize
IsDebuggerPresent
SetLastError
GetProcessHeap
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW

Exports

Exports

HsaAllocateSystemMemory
HsaAmdDebugAddressWatch
HsaAmdGetKernelExecutionMode
HsaAmdIsToolCallBackRegistered
HsaAmdRegisterDebugger
HsaAmdSetKernelExecutionMode
HsaAmdUnregisterDebugger
HsaCreateDebugEvent
HsaCreatePmu
HsaDebugFlushCache
HsaDebugWaveControl
HsaDebuggerCorrelationHandler
HsaDestroyDebugEvent
HsaDestroyServices
HsaDispatchKernel
HsaFreeSystemMemory
HsaGetDeviceAmdInfo
HsaGetDispatchDebugInfo
HsaGetExceptionPolicy
HsaGetKernelAmdInfo
HsaGetPacketAmdInfo
HsaGetServicesApiTable
HsaInitServices
HsaPmuBegin
HsaPmuCounterBlockGetInfo
HsaPmuCounterBlockGetParameter
HsaPmuCounterBlockSetParameter
HsaPmuCounterGetParameter
HsaPmuCounterGetResult
HsaPmuCounterIsEnabled
HsaPmuCounterIsResultReady
HsaPmuCounterSetEnabled
HsaPmuCounterSetParameter
HsaPmuCreateCounter
HsaPmuDestroyAllCounters
HsaPmuDestroyCounter
HsaPmuEnd
HsaPmuGetAllCounterBlocks
HsaPmuGetAllCounters
HsaPmuGetCounterBlock
HsaPmuGetCounterBlockById
HsaPmuGetEnabledCounters
HsaPmuGetInfo
HsaPmuGetParameter
HsaPmuGetState
HsaPmuSetParameter
HsaPmuWaitForCompletion
HsaReleasePmu
HsaSetAclBinary
HsaSetCallBackArguments
HsaSetCallBackFunctions
HsaSetExceptionPolicy
HsaWaitDebugEvent

Sections

.text
Size: 434KB - Virtual size: 434KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54a201438c53fa28c04525c59e5a2b58

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

newhsacore64

kernel32

Exports

Exports

Sections

.text Size: 434KB - Virtual size: 434KB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 23KB - Virtual size: 34KB

.pdata Size: 23KB - Virtual size: 22KB

.tls Size: 512B - Virtual size: 17B

.reloc Size: 122KB - Virtual size: 121KB

.text
Size: 434KB - Virtual size: 434KB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 23KB - Virtual size: 34KB

.pdata
Size: 23KB - Virtual size: 22KB

.tls
Size: 512B - Virtual size: 17B

.reloc
Size: 122KB - Virtual size: 121KB