VM8 VGA Drivers[.]iso

Sharing

Copy URL

Twitter E-mail

General

Target

VM8 VGA Drivers.iso
Size

528KB
MD5

c18ec64436c8d1fe371ab478d1819338
SHA1

a0b5d9ba4adc20269df4bef3c38b411036e1c763
SHA256

a0423aaabc55d4f4d6b62a2c2a587670aec88f04aee56202ccf994cb9de2bed8
SHA512

72863927c1d494eb665fdbbbbfe8dfc6a4b8d8d3aa8b6f3c88502329c57f430bbcecfd6ef9a7abd53fb3fc41c2416a704f28c8351ee325a880cc06ad994313e8
SSDEEP

12288:six4UgWRaB8S0ZfphGnUZ3GqyxkVBmBfT691:siWoRxS0ZH3GqyxkV

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/CL54XX.DLL
unpack002/CL54XX.SYS
unpack002/MONISEL.DLL

Files

VM8 VGA Drivers.iso
.iso
out.iso
.iso
CIRRUS.INF
CL54XX.DLL
.dll windows:4 windows x86 arch:x86

52ab9180366ac480da20ae2297cbf755

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

win32k.sys

EngFreeMem
EngDeleteSurface
EngLockSurface
EngAssociateSurface
EngCreateBitmap
EngCreateClip
EngUnlockSurface
XLATEOBJ_piVector
EngBitBlt
CLIPOBJ_bEnum
CLIPOBJ_cEnumStart
BRUSHOBJ_pvGetRbrush
EngCopyBits
BRUSHOBJ_pvAllocRbrush
EngQueryPerformanceCounter
EngDeviceIoControl
EngAllocMem
EngDeleteClip
EngCreateDeviceSurface
PATHOBJ_vGetBounds
PATHOBJ_bEnum
PATHOBJ_vEnumStart
EngFillPath
EngCreateDeviceBitmap
EngCreatePalette
EngDeletePalette
PALOBJ_cGetColors
EngStretchBlt
PATHOBJ_bEnumClipLines
PATHOBJ_vEnumStartClipLines
EngStrokePath
EngTextOut
STROBJ_bEnum

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 834B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 992B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CL54XX.SYS
.sys windows:4 windows x86 arch:x86

3bb92ed3d39a6d1fc3649e5a52c98252

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
memmove
RtlQueryRegistryValues
RtlWriteRegistryValue
ExFreePool

videoprt.sys

VideoPortInt10
VideoPortGetDeviceData
VideoPortZeroDeviceMemory
VideoPortWritePortBufferUshort
VideoPortSetBusData
VideoPortGetRegistryParameters
VideoPortMoveMemory
VideoPortCompareMemory
VideoPortInitialize
VideoPortZeroMemory
VideoPortWritePortUlong
VideoPortWritePortUshort
VideoPortWritePortUchar
VideoPortReadPortUlong
VideoPortReadPortUshort
VideoPortReadPortUchar
VideoPortGetDeviceBase
VideoPortVerifyAccessRanges
VideoPortGetAccessRanges
VideoPortSetRegistryParameters
VideoPortUnmapMemory
VideoPortMapBankedMemory
VideoPortMapMemory
VideoPortSetTrappedEmulatorPorts
VideoPortWriteRegisterBufferUchar
VideoPortReadRegisterUchar
VideoPortWriteRegisterUchar
VideoPortSynchronizeExecution
VideoPortWriteRegisterUlong
VideoPortWriteRegisterUshort
VideoPortReadRegisterUlong
VideoPortReadRegisterUshort
VideoPortGetBusData

Sections

.text
Size: 896B - Virtual size: 868B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 352B - Virtual size: 325B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 928B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MONISEL.DLL
.dll regsvr32 windows:4 windows x86 arch:x86

033e9b95ac65751c6f041a479163456b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetACP
GetOEMCP
SetHandleCount
GetFileType
GetCPInfo
LCMapStringA
LCMapStringW
HeapDestroy
HeapReAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
GetStartupInfoA
GetStdHandle
VirtualFree
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
HeapCreate
HeapSize
GlobalDeleteAtom
lstrcmpA
GetCurrentThread
WideCharToMultiByte
MulDiv
lstrcatA
GetCurrentThreadId
GlobalLock
GlobalUnlock
FindResourceA
LoadResource
LockResource
GlobalFree
lstrcpynA
lstrlenA
MultiByteToWideChar
lstrcmpiA
InterlockedDecrement
InterlockedIncrement
GetWindowsDirectoryA
WritePrivateProfileStringA
GetUserDefaultLCID
GetLocaleInfoA
GetCurrentProcess
GetLastError
GetPrivateProfileIntA
GetSystemDirectoryA
RaiseException
TerminateProcess
ExitProcess
GetCommandLineA
HeapFree
HeapAlloc
RtlUnwind
GetShortPathNameA
GetFullPathNameA
FindClose
GetVolumeInformationA
FindFirstFileA
SetEndOfFile
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
LoadLibraryA
CreateFileA
GetModuleHandleA
GetProcAddress
FreeLibrary
GetProcessVersion
SetLastError
GlobalFlags
lstrcpyA
GetVersion
GetModuleFileNameA
LocalReAlloc
SetErrorMode
TlsGetValue
GlobalReAlloc
TlsSetValue
EnterCriticalSection
SetStdHandle
GlobalHandle
GetPrivateProfileStringA
LeaveCriticalSection
TlsFree
InitializeCriticalSection
DeleteCriticalSection
TlsAlloc
LocalFree
LocalAlloc
CloseHandle
GetLocaleInfoW
GlobalAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualAlloc

user32

MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
CheckDlgButton
LoadIconA
UpdateWindow
SendDlgItemMessageA
SystemParametersInfoA
MapWindowPoints
GetSysColor
DispatchMessageA
AdjustWindowRectEx
IsWindowVisible
GetTopWindow
WinHelpA
GetClassInfoA
RegisterClassA
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenu
GetWindowTextA
GetKeyState
DefWindowProcA
SetPropA
CallNextHookEx
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetPropA
RemovePropA
CallWindowProcA
GetMessageTime
GetMessagePos
SetWindowLongA
RegisterWindowMessageA
EndDialog
IsWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
SetWindowPos
ShowWindow
PostMessageA
GetCapture
GetActiveWindow
WindowFromPoint
SetActiveWindow
GetDlgItem
GetWindowLongA
IsWindowEnabled
SetFocus
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
TabbedTextOutA
GetDlgCtrlID
GetParent
GetNextDlgTabItem
GetClientRect
ScreenToClient
SendMessageA
GetWindowRect
GetWindow
EnableWindow
ExitWindowsEx
wsprintfA
GetDesktopWindow
GetDC
ReleaseDC
DestroyIcon
DestroyMenu
GetClassNameA
ClientToScreen
PtInRect
UnregisterClassA
GetSysColorBrush
LoadCursorA
ValidateRect
GetMessageA
TranslateMessage
LoadStringA
GetCursorPos
PostQuitMessage
SetCursor
CharUpperA
MessageBoxA
GrayStringA
CreateWindowExA
DrawTextA
SetWindowsHookExA
PeekMessageA

gdi32

ExtEscape
SetBkColor
GetObjectA
SetTextColor
SaveDC
DeleteDC
SelectObject
GetStockObject
RestoreDC
SetMapMode
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
GetClipBox
ScaleWindowExtEx
GetTextMetricsA
DeleteObject
PtVisible
RectVisible
ExtTextOutA
Escape
TextOutA
SetViewportOrgEx
CreateFontIndirectA
GetDeviceCaps
CreateBitmap

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyA
RegSetValueA
RegQueryValueA
RegOpenKeyA

shell32

ExtractIconA

comctl32

DestroyPropertySheetPage
CreatePropertySheetPageA
ord17
ImageList_Destroy

ole32

CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID

oleaut32

SysStringLen
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantClear
VariantCopy
VariantChangeType
LoadTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MONISEL.HLP
MONISEL.TXT
README.1ST
TIMINGS.DAT

Sharing

General

Malware Config

Signatures

Files

52ab9180366ac480da20ae2297cbf755

Headers

File Characteristics

Imports

win32k.sys

Sections

.text Size: 85KB - Virtual size: 85KB

.data Size: 2KB - Virtual size: 2KB

INIT Size: 864B - Virtual size: 834B

.rsrc Size: 992B - Virtual size: 984B

.reloc Size: 1KB - Virtual size: 1KB

3bb92ed3d39a6d1fc3649e5a52c98252

Headers

File Characteristics

Imports

ntoskrnl.exe

videoprt.sys

Sections

.text Size: 896B - Virtual size: 868B

.data Size: 352B - Virtual size: 325B

PAGE Size: 28KB - Virtual size: 28KB

PAGE Size: 24KB - Virtual size: 24KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 928B - Virtual size: 920B

.reloc Size: 2KB - Virtual size: 2KB

033e9b95ac65751c6f041a479163456b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 114KB - Virtual size: 114KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 13KB - Virtual size: 27KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 85KB - Virtual size: 85KB

.data
Size: 2KB - Virtual size: 2KB

INIT
Size: 864B - Virtual size: 834B

.rsrc
Size: 992B - Virtual size: 984B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 896B - Virtual size: 868B

.data
Size: 352B - Virtual size: 325B

PAGE
Size: 28KB - Virtual size: 28KB

PAGE
Size: 24KB - Virtual size: 24KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 928B - Virtual size: 920B

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 114KB - Virtual size: 114KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 13KB - Virtual size: 27KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 19KB - Virtual size: 19KB