spoof_2.zip
- SHA256 022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36
Overview
overview
10Static
static
3AMI/AMIDEWINx64.exe
windows10-2004-x64
1AMI/amigendrv64.sys
windows10-2004-x64
1AMI/spoof.bat
windows10-2004-x64
1Insyde/H2O...64.exe
windows10-2004-x64
Insyde/segwindrv.cat
windows10-2004-x64
8Insyde/segwindrv.inf
windows10-2004-x64
1Insyde/seg...64.sys
windows10-2004-x64
1Insyde/spoof.bat
windows10-2004-x64
VHD/1.txt
windows10-2004-x64
1VHD/VHD.bat
windows10-2004-x64
1check.bat
windows10-2004-x64
5tweaks/1.bat
windows10-2004-x64
10tweaks/1.reg
windows10-2004-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AMI/AMIDEWINx64.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AMI/amigendrv64.sys
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
AMI/spoof.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Insyde/H2OSDE-Wx64.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Insyde/segwindrv.cat
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Insyde/segwindrv.inf
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Insyde/segwindrvx64.sys
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Insyde/spoof.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
VHD/1.txt
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
VHD/VHD.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
check.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
tweaks/1.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral13
Sample
tweaks/1.reg
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target spoof_2.zip
- Size 565KB
- Sample240528-mexmlage85
- SHA256 022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36
- MD5 79aa575e7e2b033646f74f69e44c60d4
- SHA1 6feff8cad2f9ae2b831343fa7bfcb408ffe23b92
- SHA512 732e1ae4488765d0a4b5919900c548272ce932d97743a1c8adca26d437c9c4e38a78b45c5ccf15acd51d0042f33c6d132e98a6dfd92132d3bc97ff58984de006
- SSDEEP 12288:Bq0wZ837dYoz2ko5wLJXOKfegCEkwg+al7+fzohptnT1cbyx1fR:Y0fLdYTyLJXN2gCEV2KfzAnBcbyxJR
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/AMI/AMIDEWINx64.EXE unpack001/Insyde/H2OSDE-Wx64.exe unpack001/Insyde/segwindrvx64.sys
File Explorer
-
spoof_2.zip.zip 565KB
-
AMI/AMIDEWINx64.EXE.exe 377KB
-
AMI/amigendrv64.sys.sys 35KB
-
AMI/spoof.bat57B
-
Insyde/H2OSDE-Wx64.exe.exe 918KB
-
Insyde/segwindrv.cat10KB
-
Insyde/segwindrv.inf4KB
-
Insyde/segwindrvx64.sys.sys 103KB
-
Insyde/spoof.bat39B
-
VHD/1.txt51B
-
VHD/VHD.bat82B
-
check.bat274B
-
tweaks/1.bat253B
-
tweaks/1.reg1KB
AMI/AMIDEWINx64.EXE
- IMPHASH e3d5de629e09ae6898196a1418661d7f
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
SetHandleCount
LoadLibraryExW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetEndOfFile
SetStdHandle
GetSystemFirmwareTable
GetVersionExA
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
LocalSize
LocalAlloc
lstrlenA
FormatMessageA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
WriteConsoleW
SetFilePointer
GetProcessHeap
advapi32
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
CreateServiceA
shell32
ShellExecuteA
user32
ExitWindowsEx
RegisterClassExA
DefWindowProcA
DispatchMessageA
BlockInput
GetMessageA
MessageBoxA
CreateWindowExA
SystemParametersInfoA
TranslateMessage
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
AMI/amigendrv64.sys
- IMPHASH 35ce4f00ca063f6bffa0759d88c3a148
- SHA256 b9e8de155fb9aabb4760034a65855130eb85aadc88963e40e2be87b049c025bf
- MD5 8d533ae1500f743a177b27c88a241163
- SHA1 52c25cf4c903714fa52870a16d143fb6aeb0fa99
- SHA512 546c9309b9b078ce4c49a3b56ec8d77b0fd4c0bd583f4bce53705f854fe2addba5c8029ed8b8da9e944b2c212d2ee0508095bf20c12632b760a5c271d19940de
- SSDEEP 384:mrzqfCQlZluZfnktrQsHGh1jEiI4IHith5kCN88ZGmGovy8ZpHcS8FRJvIsWAR9k:+dCluVG0zuiv1yiR89PL9zIf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
69:ec:ee:5d:c6:96:72:bc:b8:ad:ce:12:99:01:f1:3a:fd:c4:21:b7:e9:99:89:91:3b:f4:8a:57:a7:bf:15:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 23, 2024
Digest
69:ec:ee:5d:c6:96:72:bc:b8:ad:ce:12:99:01:f1:3a:fd:c4:21:b7:e9:99:89:91:3b:f4:8a:57:a7:bf:15:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Apr 7, 2023
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:f3:15:8e:a5:7d:1c:55:9f:29:00:00:00:00:00:f3
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2023 - Dec 15, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\AMI_Code\Flash\00_AFUDriver\AFUDriverSourceCode_Build\AFUDriverSourceCode_5.6_20230321\AmiFlashDriverSrc\sys\x64\Release\amigendrv64.pdb
ntoskrnl.exe
ZwUnmapViewOfSection
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
KfRaiseIrql
MmMapIoSpace
MmUnmapIoSpace
RtlCompareMemory
ZwClose
ZwOpenSection
ZwMapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
ObReferenceObjectByHandle
RtlGetVersion
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
850B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=262, version=24610,
count=4, id=260, version=24610,
count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
AMI/spoof.bat
- SHA256 74975bffd064e9e27f44db7738b5f4c971ca1401b5e5d89f4aa50835801abb5c
- MD5 70c372a580ee13ad16ff67d3cc0ff0c6
- SHA1 7e92af45a827b70404573f9f8339b2c9297793ec
- SHA512 8dd0f5cbf1e66061f11d9129b6da90046ffc36742b2884e271399f17f096dbaf5c1db80d2b4c3e4594961021c96e04c623c684c5c6511cfe6e64b5527d1e50ed
- MD5 SHA1 SHA512
Insyde/H2OSDE-Wx64.exe
- IMPHASH f2531102fa40c55e6ccc64a53bc417cc
- SHA256 412e058e92b2498a4dcc4bf70b9aeedc8361f97be0fc071662d5cc480fd965ae
- MD5 42aedfbe60926aac1464a62d8d1c4df6
- SHA1 89b2cdb05a7ee068b3601311331f057b0364eedf
- SHA512 ec8a1962c37f06a8ebab527a492d30ace1fb38cfa56d2dfed20fdb79a28693a555e8c74834703e97218575319433b95ccbbff6ca1c1f01adfeec79447844e7ea
- SSDEEP 24576:wtT0dc9f8XTEtvM6kvvJ+11u4CN5oHDsUBmT:PTovsc11sN5ojspT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
525928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
lstrcpyA
GetLocalTime
GetModuleFileNameA
GetCommandLineA
CreateFileA
lstrlenA
GetCurrentProcess
WaitForSingleObject
GetWindowsDirectoryA
GetExitCodeProcess
CreateProcessA
SetFileAttributesA
DeviceIoControl
GetCurrentDirectoryA
GetVersion
GetEnvironmentVariableA
GetFullPathNameA
FreeLibrary
FormatMessageA
GetFileAttributesA
FindFirstFileA
FindClose
LoadLibraryA
LocalAlloc
FindNextFileA
LocalSize
LocalFree
DeleteFileA
GetModuleHandleW
lstrcmpiA
GetModuleFileNameW
GetFirmwareEnvironmentVariableA
WideCharToMultiByte
MultiByteToWideChar
GetSystemFirmwareTable
SetEnvironmentVariableA
CreateFileW
OutputDebugStringW
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleA
SetConsoleTextAttribute
SetConsoleCursorPosition
SetConsoleTitleA
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetLastError
GetStdHandle
LoadLibraryExW
ReadConsoleW
DeleteFileW
Sleep
CloseHandle
MoveFileExW
GetFileAttributesExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetTimeZoneInformation
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
GetFileType
SetEndOfFile
GetCurrentThreadId
GetOEMCP
GetACP
IsValidCodePage
GetProcessHeap
HeapSize
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStringTypeW
HeapFree
RtlPcToFileHeader
HeapAlloc
GetSystemTimeAsFileTime
AreFileApisANSI
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
user32
wsprintfA
CharNextA
ExitWindowsEx
advapi32
LookupPrivilegeValueA
RegCreateKeyExA
RegSetValueExA
AdjustTokenPrivileges
RegOpenKeyExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
ole32
CoCreateGuid
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
setupapi
SetupDiGetINFClassA
SetupDiGetDeviceInfoListDetailA
SetupDiGetDeviceRegistryPropertyA
SetupOpenInfFileA
SetupDiGetDeviceInstallParamsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInfoA
SetupDiCreateDeviceInfoA
SetupDiCreateDeviceInfoListExA
SetupCloseInfFile
CM_Get_Device_ID_ExA
SetupDiCallClassInstaller
SetupDiGetClassDevsExA
SetupDiSetClassInstallParamsA
SetupDiSetDeviceRegistryPropertyA
SetupFindFirstLineA
SetupGetStringFieldA
SetupDiCreateDeviceInfoList
shlwapi
PathFileExistsA
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
193KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=13, id=223, version=20806,
count=86, id=225, version=20806,
count=242, id=224, version=20806,
count=23, id=203, version=65501,
count=184, id=1, productName=Unmarked objects,
count=57, id=229, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
Insyde/segwindrv.cat
- SHA256 e830efe7786b0fb9dd84eb647614fa1795ec5caa605d44d9a13f0fdbd0f4d6b5
- MD5 43d3603cf918445cbd1d7253b49bf527
- SHA1 fabfaee55f2c4e6ca508d735b297bdb738ab1c7d
- SHA512 183b8498e4c86966050be324a027fc0a7f8179bb77d032ec97cf64ab91dac72c8e7fcdda36c733c2815973b72c91cee19d3263376a7e3b955c616f548690186e
- SSDEEP 192:nPv5lU3j25JC5NFvE4uyK6iWPFWQFe8imCLqnajvdjA/2T:n35mFhiWPFRDKLljdjcM
- MD5 SHA1 SHA512 SSDEEP
Insyde/segwindrv.inf
- SHA256 e1449864c7403b9cd3d828c6fc9710fe1fbb3f35c7b6522a5dcbcf97685f40d7
- MD5 843fb7475608ce359da7cbd48fa3ab1d
- SHA1 ae16643aa1756b34391e4c615958343ecb17b153
- SHA512 9db610ebff1ab1e24147abadf10f978eab95358f2b0806d17fb8df6e53723b0523dd26d0207430d029f5b6826a02c3a5d73ff01d8f6e28d53e82c230075f2b34
- SSDEEP 48:rRFH5oXHIYYzQS6QLOOLcqnXT+E6tE58HWi1LRfuwGRfuwpkHo7uFf:rCIYY0SzgLRfuwGRfuwi
- MD5 SHA1 SHA512 SSDEEP
Insyde/segwindrvx64.sys
- IMPHASH 8a3d3f89c1a7e11f163988eab00064a1
- SHA256 b44f4384f95cc9d3f86f0c27fc0abba9a291a7cc24483f41e70c1234bc61edc6
- MD5 e46dfe45c1714f4920d3fd2546f2f630
- SHA1 28cdb0b48c1d88d71421ec9e40ce52836ab79956
- SHA512 97480d19e22ebef836e61f33d5540c41a08a9edc71af97a59fef71b3d60abd9ab78b32896ee0812cae1780da08f875e3cb32c048edf4fcae523fa04e23d2246c
- SSDEEP 1536:yALHKmz+6n3qOZhiIjyvxjSd0CG7wMLw6JSoe80/ttsw:bHKmz+C6ATjuxjSdq75w6JFstaw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
53104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
g:\segwindriver\kmdf_insydedriver\driver\objfre_win7_amd64\amd64\segwindrvx64.pdb
ntoskrnl.exe
ExSystemTimeToLocalTime
_vsnprintf
ZwClose
RtlTimeToTimeFields
ZwWriteFile
RtlInitAnsiString
MmGetPhysicalAddress
RtlFreeAnsiString
RtlCopyString
RtlEqualString
ZwCreateFile
MmFreeContiguousMemorySpecifyCache
MmUnmapIoSpace
MmMapIoSpace
RtlCompareMemory
MmAllocateContiguousMemorySpecifyCache
_purecall
strrchr
KeBugCheckEx
RtlCopyUnicodeString
RtlQueryRegistryValues
ExFreePoolWithTag
ExAllocatePoolWithTag
wdfldr.sys
WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
init
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=136, version=30729,
count=31, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Insyde/spoof.bat
- SHA256 9a33bcec16224a280916ee5362c09e5c4b9e23b578802824250710d8cb5e3bdf
- MD5 00b669e9102e6055f3ffb59c495f9590
- SHA1 33663eeb1eb9dbd1fb9d7d8da05ff682a0b77817
- SHA512 64564a7c15c35f2a8f2f0490b015461831ceb8db1d23481b2fed6b396333d931663f2fe3684b7d54dc3ca99ea89b8527d570ee19969561a23bf71dcfee93a5f6
- MD5 SHA1 SHA512
VHD/1.txt
- SHA256 7c6672c0a37a5e9aa5f7216c4ede8fb29bbb01021553fd822e7a9b408242fc98
- MD5 ac20e2b5870fbe495b2e4d5450cf2915
- SHA1 b905055099236cf8fa841ed6277b97d1af4fbfaf
- SHA512 e659ffaf078f31c759eaf391dc0f08595be86ceed9ec4d16a140f3b80c847cf8db006942d12b5740448dc6a0c5cb8379fcd896ddefd9079a38b96cedc95da189
- MD5 SHA1 SHA512
VHD/VHD.bat
- SHA256 569a3ea35752c5f848269f90cc8fd72f3e587e44c987e9986af242ba3cbc93d8
- MD5 945e0ff83a6f23cf0568ba1444af9384
- SHA1 184d295e43c244bb4891b79927e45049f9a1b8fe
- SHA512 00991d10ec9fb366288b1a025eac20e2986ed31a09853dacc47dca21b420213d251c72c6006b32c02f77611284496d4ce2e4511e818de67d82e87342fd9b7789
- MD5 SHA1 SHA512
check.bat
- SHA256 3c36f73644642fa71c86fe48d24cc47f5293cedcec8bd0981d111e5823bda3ea
- MD5 e8db7ba2184c7b20e20182d01522e6c6
- SHA1 877be10ebd8d6281da715d96b4741dddbbd258c3
- SHA512 1024d79d1b3f6208c577b7c45ac8e3a985887736af0712fbec2e54c837c4d6de14afa7dfbe58266d157490952c9a857a402ec3ec393d560d6611273aac55d529
- MD5 SHA1 SHA512
tweaks/1.bat
- SHA256 9ee833b3b341ab2fbbc1b215c2613a3cb947aa5174122f69c87068c54d3b6f8a
- MD5 ce17bbdf67566edb48a72c10dc53aa19
- SHA1 5463f627871b844a098871aa5dbe43ef9f39d09e
- SHA512 6c76ccb6b1bf9c40c62c50ab04fe053f7358496eafa0345f14dc0a5f2e29cf58a3f87e301efe876ba9d2ac9f3ca5471d7af991d3f4c7097fd1f55dc9976360da
- MD5 SHA1 SHA512
tweaks/1.reg
- SHA256 648d42f046201351a60f1ecb107edab0a8ec7db8512886fd87296717df435369
- MD5 5f39bbc46845d5d3633aaa1ee20a1c44
- SHA1 b7454d19b11d3af833a45608f3631933cd29e4a8
- SHA512 273ad7eb69bea6f1faf5c6d73ad14dbfca01232d6cabba1e208e4c8dd36551c5c3c9059d6474638de635bcfea195a2977566a415c1495f0d16bd9ced4b890703
- MD5 SHA1 SHA512