broadcom_bcm_43xx_wireless_7_12_39_13_win8_64bit_whql[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

broadcom_bcm_43xx_wireless_7_12_39_13_win8_64bit_whql.zip
Size

16.1MB
MD5

ef31e6ccf0895a1d89d26fe6817fdae2
SHA1

e398c76989fba525ca4c00850d1f338e99123ddd
SHA256

efee7798886cc210e6959a4f206e30601fd9ed0566ce7135cce15b569cc6d269
SHA512

7b6bc325d63b43b2abbe2a8feb20dde0b2dc4836c9d0e4d4d5d72d67fd4859d3d1f37a6602ebf6b7dd12d798a431a7e56c541e4792fe2bc43cf5507e260d57ef
SSDEEP

393216:AAwdKrNjSZd6iV8MS5EpAdE0+OVVi580I+xOYqMF:AIN2D6iV8kpUiG0FF

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/broadcom_wlan_7.12.39.13/Setup/ISSetup.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/broadcom_wlan_7.12.39.13/Setup/ISSetup.dll	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/broadcom_wlan_7.12.39.13/Driver/Win8.1/bcmihvsrv64.dll
unpack001/broadcom_wlan_7.12.39.13/Driver/Win8.1/bcmihvui64.dll
unpack001/broadcom_wlan_7.12.39.13/Setup/ISSetup.dll

Files

broadcom_bcm_43xx_wireless_7_12_39_13_win8_64bit_whql.zip
.zip
broadcom_wlan_7.12.39.13/Driver/Win8.1/bcm43xx64.cat
broadcom_wlan_7.12.39.13/Driver/Win8.1/bcmihvsrv64.dll
.dll windows:6 windows x64 arch:x64

25df3ad3f4ba40acdea95c14a83d5c4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\build\BISON03T_REL_7_12_26_9.win8x_external_wl.202619121\src\wl\cpl\components\sup\ihv\x64\Releasewb\Bcm\bcmihvsrv64.pdb

Imports

setupapi

SetupDiSetDevicePropertyW
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

bcrypt

BCryptDecrypt
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateKeyPair
BCryptExportKey
BCryptSignHash
BCryptRegisterProvider
BCryptUnregisterProvider
BCryptAddContextFunctionProvider
BCryptRemoveContextFunctionProvider
BCryptSetProperty
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptDestroyKey
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDeriveKey
BCryptSecretAgreement
BCryptVerifySignature
BCryptDestroySecret
BCryptAddContextFunction

ncrypt

NCryptFreeObject
NCryptSignHash

advapi32

IsValidSecurityDescriptor
CryptGenRandom
CryptReleaseContext
SetNamedSecurityInfoW
GetNamedSecurityInfoW
MakeAbsoluteSD
GetTokenInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetAclInformation
GetAce
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
OpenProcessToken
GetSecurityDescriptorLength
CryptAcquireContextW
RevertToSelf
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ImpersonateLoggedOnUser

crypt32

CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CryptProtectMemory
CryptRegisterOIDInfo
CryptUnregisterOIDInfo
CryptUnprotectMemory
CertOpenSystemStoreW
CryptProtectData
CryptUnprotectData
CryptStringToBinaryW
CryptBinaryToStringW
CertDuplicateCertificateContext
CertGetCertificateChain
CertFreeCertificateChain
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext

rpcrt4

UuidCreate

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

kernel32

HeapAlloc
HeapFree
GetProcessHeap
LocalFree
CloseHandle
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GlobalMemoryStatus
ResetEvent
CreateEventW
Sleep
CreateThread
DisableThreadLibraryCalls
GetModuleHandleW
WideCharToMultiByte
GetTimeFormatW
WaitForSingleObject
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleFileNameW
WTSGetActiveConsoleSessionId
ResumeThread
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetModuleFileNameA
GetStartupInfoW
GetFileType
GetStdHandle
GetStringTypeW
GetCPInfo
GetOEMCP
LoadLibraryExW
FreeLibrary
GetACP
GetTickCount
TlsFree
TlsSetValue
LoadLibraryA
LCMapStringW
OutputDebugStringW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetVersionExA
WriteConsoleW
SetStdHandle
CreateTimerQueueTimer
FlushFileBuffers
ReadConsoleW
SetEndOfFile
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
TlsGetValue
TlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetEvent
FindClose
FindFirstFileExW
FindNextFileW
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileSize
ReadFile
WriteFile
GetCurrentProcess
GetCurrentThread
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
RtlPcToFileHeader
RaiseException
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
HeapSize
SetLastError
IsValidCodePage
InitializeCriticalSectionAndSpinCount

ole32

CoCreateInstance
PropVariantClear
CoInitializeEx
CoUninitialize

oleaut32

SysStringByteLen
VariantClear
VariantInit
SysFreeString
SysAllocString

userenv

GetAllUsersProfileDirectoryW
GetUserProfileDirectoryW

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
GetKeyStorageInterface
GetSecretAgreementInterface
GetSignatureInterface

Sections

.text
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
broadcom_wlan_7.12.39.13/Driver/Win8.1/bcmihvui64.dll
.dll regsvr32 windows:6 windows x64 arch:x64

a9bd5cfa3041d8082ac6f11f315edcde

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\build\BISON03T_REL_7_12_26_9.win8x_external_wl.202619121\src\wl\cpl\components\sup\ihv\x64\Releasewb\Bcm\bcmihvui64.pdb

Imports

crypt32

CryptBinaryToStringW
CertCompareCertificateName
CertNameToStrW
CertGetNameStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertCloseStore
CertFindCertificateInStore
CertCompareCertificate
CertFreeCertificateContext
CertOpenSystemStoreW
CryptUnprotectData
CryptProtectData

cryptui

CryptUIDlgViewCertificateW

rpcrt4

UuidToStringW
RpcStringFreeW

kernel32

QueryActCtxW
CreateActCtxW
ActivateActCtx
LoadLibraryW
GetModuleFileNameW
DeactivateActCtx
GetLastError
SetLastError
GetProcAddress
DisableThreadLibraryCalls
LocalAlloc
OutputDebugStringA
FindActCtxSectionStringW
InitializeCriticalSection
GetDateFormatW
SystemTimeToFileTime
CompareFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
GetModuleHandleW
EnumResourceNamesW
FindResourceExW
LoadResource
GetUserDefaultLangID
LeaveCriticalSection
SetThreadLocale
GetThreadLocale
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleExW
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
OutputDebugStringW
LCMapStringW
HeapReAlloc
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
WriteFile
LocalFree
GetProcessHeap
HeapFree
HeapAlloc
GetStdHandle
FreeLibrary
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CloseHandle
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetOEMCP
GetACP
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
RtlPcToFileHeader
RaiseException
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
HeapSize
RtlUnwindEx
RtlLookupFunctionEntry
GetStringTypeW
IsValidCodePage

user32

MessageBoxW
LoadStringW
SetWindowLongPtrW
EnableWindow
SetWindowTextW
GetPropW
GetWindowTextLengthW
GetFocus
InvalidateRect
UpdateWindow
GetClientRect
SendMessageW
GetWindowTextW
GetWindow
GetWindowLongPtrW
EndDialog
CheckDlgButton
ShowWindow
IsDlgButtonChecked
RemovePropW
PostMessageW
DialogBoxParamW
GetParent
SetPropW
GetDlgItem

advapi32

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegEnumKeyW
RegGetValueW
RegQueryValueExW

ole32

CLSIDFromString
StringFromIID
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
StringFromCLSID

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocStringByteLen
VariantClear
SysStringLen
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
broadcom_wlan_7.12.39.13/Driver/Win8.1/bcmwl63.inf
broadcom_wlan_7.12.39.13/Driver/Win8.1/bcmwl63a.sys
.sys windows:6 windows x64 arch:x64

822fa4180b9a91a63bf96b2603476a2d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5a:e2:e6:38:fd:f6:40:16:11:b8:d5:51:2c:9a:ec:e7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/03/2014, 00:00

Not After

15/06/2016, 23:59

Subject

CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=PQA (Product Quality Assurance),O=Broadcom Corporation,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:a9:09:b1:ba:3e:3e:9f:51:a9:fc:1f:f1:18:f9:db:07:4d:4c:bb
Signer

Actual PE Digest

37:a9:09:b1:ba:3e:3e:9f:51:a9:fc:1f:f1:18:f9:db:07:4d:4c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\build\BISON03T_REL_7_12_26_9.win8x_external_wl.202619121\src\wl\sys\wdm\obj\win8x_nic\free\x64\bcmwl63a.pdb

Imports

ntoskrnl.exe

strncat
strncmp
strstr
strcat_s
RtlTimeToTimeFields
strcpy_s
ExSystemTimeToLocalTime
_vsnprintf_s
_snprintf_s
RtlCompareMemory
KeLowerIrql
MmMapIoSpace
ExGetFirmwareEnvironmentVariable
IoWMIOpenBlock
KfRaiseIrql
MmUnmapIoSpace
RtlInitString
MmGetSystemRoutineAddress
IoBuildSynchronousFsdRequest
IoWMIQueryAllData
RtlAnsiStringToUnicodeString
IoWMIRegistrationControl
sprintf
IoReuseIrp
MmAllocateContiguousMemorySpecifyCache
MmMapLockedPagesSpecifyCache
MmGetPhysicalAddress
MmFreeContiguousMemorySpecifyCache
IofCallDriver
ObfDereferenceObject
RtlCopyUnicodeString
IoAllocateIrp
RtlFreeAnsiString
IoFreeIrp
KeWaitForSingleObject
IoUnregisterPlugPlayNotification
IoGetDeviceObjectPointer
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
KeInitializeEvent
KeSetEvent
RtlInitUnicodeString
IoRegisterPlugPlayNotification
ExFreePoolWithTag
ExAllocatePoolWithTag
KeAcquireSpinLockRaiseToDpc
KeInitializeSpinLock
KeReleaseSpinLock
DbgPrint
strrchr
strncpy
strchr
strcmp

hal

KeStallExecutionProcessor

ndis.sys

NdisMSetBusData
NdisQueueIoWorkItem
NdisFreeIoWorkItem
NdisMSetMiniportAttributes
NdisMGetDmaAlignment
NdisMGetDeviceProperty
NdisOpenConfigurationEx
NdisMMapIoSpace
NdisReadConfiguration
NdisMResetComplete
NdisMAllocatePort
NdisMGetBusData
NdisAllocateIoWorkItem
NdisMSendNetBufferListsComplete
NdisMDeregisterMiniportDriver
NdisAllocateNetBufferListPool
NdisCloseConfiguration
NdisMUnmapIoSpace
NdisMNetPnPEvent
NdisWriteConfiguration
NdisMRegisterScatterGatherDma
NdisMRegisterMiniportDriver
NdisMFreePort
NdisMIndicateReceiveNetBufferLists
NdisGetVersion
NdisGetSystemUpTimeEx
NdisMOidRequestComplete
NdisFreeNetBufferListPool
NdisCancelTimerObject
NdisSetTimerObject
NdisWriteErrorLogEntry
NdisAllocateNetBufferAndNetBufferList
NdisFreeTimerObject
NdisMSleep
NdisAllocateTimerObject
NdisMDeregisterScatterGatherDma
NdisMAllocateSharedMemory
NdisMRegisterInterruptEx
NdisMAllocateSharedMemoryAsync
NdisWaitEvent
NdisMIndicateStatusEx
NdisSetEvent
NdisResetEvent
NdisAllocateMdl
NdisMSynchronizeWithInterruptEx
NdisInitializeEvent
NdisMDeregisterInterruptEx
NdisFreeMdl
NdisMFreeSharedMemory
NdisFreeNetBufferList
NdisFreeMemory
NdisAllocateMemoryWithTagPriority
NdisMPauseComplete

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
broadcom_wlan_7.12.39.13/Setup/ISLangUni.ini
broadcom_wlan_7.12.39.13/Setup/ISSetup.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProductSKU
InstallEngineTypelib
RemoveEngineTypelib

Sections

UPX0
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 351KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
broadcom_wlan_7.12.39.13/Setup/_Setup.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:69:39:c4:75:d5:3c:1d:70:99:2d:b8:a8:7e:b7:d3
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

10/02/2006, 00:00

Not After

20/02/2008, 23:59

Subject

CN=Macrovision Corporation,OU=ENGINEERING,O=Macrovision Corporation,L=Schaumburg,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

63:83:74:e8:97:34:e0:90:48:df:f3:6f:7b:e1:f5:af:d2:f2:06:98
Signer

Actual PE Digest

63:83:74:e8:97:34:e0:90:48:df:f3:6f:7b:e1:f5:af:d2:f2:06:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 360KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
broadcom_wlan_7.12.39.13/Setup/data1.cab
broadcom_wlan_7.12.39.13/Setup/data1.hdr
broadcom_wlan_7.12.39.13/Setup/data2.cab
broadcom_wlan_7.12.39.13/Setup/layout.bin
broadcom_wlan_7.12.39.13/Setup/setup.exe
.exe windows:4 windows x86 arch:x86

a5fd4def1510f7b3943f9807bf555a4d

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:69:39:c4:75:d5:3c:1d:70:99:2d:b8:a8:7e:b7:d3
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

10/02/2006, 00:00

Not After

20/02/2008, 23:59

Subject

CN=Macrovision Corporation,OU=ENGINEERING,O=Macrovision Corporation,L=Schaumburg,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e0:21:01:78:b3:d4:61:95:de:96:92:a8:76:12:64:bb:74:39:de:75
Signer

Actual PE Digest

e0:21:01:78:b3:d4:61:95:de:96:92:a8:76:12:64:bb:74:39:de:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

GetShortPathNameA
SetEvent
HeapDestroy
GetDriveTypeA
GetExitCodeProcess
CopyFileA
lstrcpynA
GetFileAttributesA
FindClose
FindFirstFileA
CreateDirectoryA
GetCurrentThreadId
LoadLibraryA
SetFilePointer
LoadLibraryExA
GetTickCount
GetVersion
GetWindowsDirectoryA
FormatMessageA
LocalFree
SetFileAttributesA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
SizeofResource
GetTempPathA
GlobalSize
FreeResource
GetLocalTime
GetCurrentProcessId
SearchPathA
FindNextFileA
GetTempFileNameA
TerminateProcess
IsBadReadPtr
VirtualQuery
VirtualProtect
ResetEvent
QueryPerformanceCounter
SystemTimeToFileTime
lstrcmpA
GetCurrentThread
MoveFileExA
GetDiskFreeSpaceA
GetSystemDirectoryA
GetSystemInfo
GetPrivateProfileStringA
GetPrivateProfileIntA
MultiByteToWideChar
lstrcpyA
lstrcmpiA
lstrlenA
GetSystemDefaultLangID
lstrcatA
SetLastError
GetLastError
WideCharToMultiByte
CompareStringA
CompareStringW
GetVersionExA
GetProcAddress
MulDiv
GetPrivateProfileSectionNamesA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
TlsGetValue
TlsAlloc
TlsSetValue
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetCommandLineA
GetStartupInfoA
RaiseException
HeapReAlloc
HeapAlloc
HeapFree
RtlUnwind
DeleteCriticalSection
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
Sleep
CloseHandle
InitializeCriticalSection
ReleaseMutex
CreateMutexA
ReadFile
WriteFile
CreateEventA
QueryPerformanceFrequency
InterlockedDecrement
InterlockedIncrement
CreateFileA
CreateThread
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
SetErrorMode
FindResourceExA
FindResourceA
LoadResource
LockResource
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
WaitForSingleObject
ExitProcess
GetCurrentProcess
DuplicateHandle
GetThreadContext
VirtualProtectEx
WriteProcessMemory
FlushInstructionCache
SetThreadContext
ResumeThread
DeleteFileA
RemoveDirectoryA
AddAtomA
WritePrivateProfileStringA
GetAtomNameA
lstrlenW
CreateProcessA

user32

MoveWindow
EndDialog
LoadIconA
GetDlgItem
SendMessageA
SetDlgItemTextA
SetWindowLongA
DialogBoxIndirectParamA
CharUpperA
WaitForInputIdle
wsprintfA
GetWindowRect
GetWindowLongA
ShowWindow
IntersectRect
SetWindowTextA
RegisterClassExA
CreateWindowExA
GetClassNameA
GetDialogBaseUnits
EnumChildWindows
CallWindowProcA
CharLowerBuffA
GetDlgItemTextA
SetFocus
IsDlgButtonChecked
CheckDlgButton
BeginPaint
EndPaint
FillRect
ScreenToClient
GetParent
GetWindow
SystemParametersInfoA
MapWindowPoints
SetWindowPos
GetWindowTextLengthA
GetWindowTextA
GetWindowPlacement
SendDlgItemMessageA
DefWindowProcA
GetPropA
EnableMenuItem
SetPropA
RemovePropA
IsWindow
GetSysColor
IsDialogMessageA
TranslateMessage
LoadImageA
CreateDialogParamA
GetDC
ReleaseDC
MessageBoxA
GetMessageA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
CharNextA
PostThreadMessageA
LoadStringA
SetActiveWindow
DestroyWindow
CreateDialogIndirectParamA
SetForegroundWindow
GetClientRect
EnableWindow
IsWindowEnabled
GetDesktopWindow
SetWindowRgn
GetWindowDC
UpdateWindow
InvalidateRect
DrawIcon
MapDialogRect
DrawFocusRect
InflateRect
DrawTextA
CopyRect
PostMessageA

gdi32

CreateCompatibleBitmap
CreateDCA
GetStockObject
GetTextExtentPoint32A
CreatePatternBrush
DeleteMetaFile
SetMetaFileBitsEx
SetStretchBltMode
SelectClipRgn
SetPixel
PatBlt
PlayMetaFile
StretchBlt
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
CreateDIBitmap
SaveDC
SetBkMode
SetTextColor
TextOutA
RestoreDC
GetTextExtentPointA
CreateFontIndirectA
SetBkColor
CreateRectRgn
DeleteObject
CreateSolidBrush
GetDIBColorTable
GetSystemPaletteEntries
CreatePalette
CreateHalftonePalette
GetDeviceCaps
GetObjectA
CreateCompatibleDC
UnrealizeObject
SelectPalette
RealizePalette
SelectObject
BitBlt
DeleteDC
SetMapMode

advapi32

RegCloseKey
OpenThreadToken
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegCreateKeyA
RegQueryValueA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetMalloc

ole32

StringFromGUID2
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoCreateGuid
StringFromCLSID
CoTaskMemFree
GetRunningObjectTable
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize

oleaut32

SysAllocStringLen
SysAllocString
SysStringLen
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
VariantChangeType
GetErrorInfo
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
VariantClear
VariantCopy
SysReAllocStringLen

lz32

LZCopy
LZOpenFileA
LZClose

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

Sections

.text
Size: 276KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
broadcom_wlan_7.12.39.13/Setup/setup.ini
broadcom_wlan_7.12.39.13/Setup/setup.inx
broadcom_wlan_7.12.39.13/Setup/setup.iss

Sharing

General

Malware Config

Signatures

Files

25df3ad3f4ba40acdea95c14a83d5c4b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

bcrypt

ncrypt

advapi32

crypt32

rpcrt4

wtsapi32

kernel32

ole32

oleaut32

userenv

Exports

Exports

Sections

.text Size: 316KB - Virtual size: 315KB

.rdata Size: 133KB - Virtual size: 132KB

.data Size: 69KB - Virtual size: 93KB

.pdata Size: 20KB - Virtual size: 20KB

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 14KB - Virtual size: 13KB

a9bd5cfa3041d8082ac6f11f315edcde

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

cryptui

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 120KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 8KB - Virtual size: 17KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 2KB - Virtual size: 2KB

822fa4180b9a91a63bf96b2603476a2d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

5a:e2:e6:38:fd:f6:40:16:11:b8:d5:51:2c:9a:ec:e7Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

37:a9:09:b1:ba:3e:3e:9f:51:a9:fc:1f:f1:18:f9:db:07:4d:4c:bbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text
Size: 316KB - Virtual size: 315KB

.rdata
Size: 133KB - Virtual size: 132KB

.data
Size: 69KB - Virtual size: 93KB

.pdata
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 14KB - Virtual size: 13KB

.text
Size: 121KB - Virtual size: 120KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 8KB - Virtual size: 17KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 2KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

5a:e2:e6:38:fd:f6:40:16:11:b8:d5:51:2c:9a:ec:e7
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

37:a9:09:b1:ba:3e:3e:9f:51:a9:fc:1f:f1:18:f9:db:07:4d:4c:bb
Signer

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 2.2MB - Virtual size: 4.2MB

.pdata
Size: 111KB - Virtual size: 110KB

PAGE
Size: 1KB - Virtual size: 1KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 6KB - Virtual size: 5KB

UPX0
Size: - Virtual size: 1.1MB

UPX1
Size: 351KB - Virtual size: 352KB

.rsrc
Size: 128KB - Virtual size: 132KB

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

03:69:39:c4:75:d5:3c:1d:70:99:2d:b8:a8:7e:b7:d3
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

63:83:74:e8:97:34:e0:90:48:df:f3:6f:7b:e1:f5:af:d2:f2:06:98
Signer

.text
Size: 4KB - Virtual size: 6B

.rsrc
Size: 360KB - Virtual size: 357KB

.reloc
Size: 4KB - Virtual size: 12B

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

03:69:39:c4:75:d5:3c:1d:70:99:2d:b8:a8:7e:b7:d3
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

e0:21:01:78:b3:d4:61:95:de:96:92:a8:76:12:64:bb:74:39:de:75
Signer

.text
Size: 276KB - Virtual size: 274KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 24KB - Virtual size: 29KB

.rsrc
Size: 112KB - Virtual size: 109KB