5303681edbe6884751d33bc6e441d550N[.]cab

Sharing

Copy URL Twitter E-mail

General

Target

5303681edbe6884751d33bc6e441d550N.cab
Size

5.1MB
MD5

5303681edbe6884751d33bc6e441d550
SHA1

4d723f7a67d828faf214685ef2b045ad95e3c8f6
SHA256

4f110597adef7cc7f851b916d62dc5c600ef276b877d3dc4921b9db3fc533a6a
SHA512

31b4326218c6729fd0bb1f38371b0da79ad513df42d8d9301366ba87a91c0dfd6de4379fa5650aa9e6d988550330d6bd485c4501b10e6c9a45ce9bf1d411ab5e
SSDEEP

98304:4LwQn2D9ElSoFbWNbkkJwaXB6ieYjPjrsu7lhcPYPRFp1LqvZjOzE1bwE2zf1:4j2RElSoVWN91x6ieQcu7fcPYP3ptamh

Score

1^/10

Malware Config

Signatures

Files

5303681edbe6884751d33bc6e441d550N.cab
.cab
mfxplugin32_hw.dll
.dll windows:6 windows x86 arch:x86

3ccea29ab159671d31773c19ed69fcd2

Code Sign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:ad:df:c1:8b:5f:a4:a3:67:48:9f:ad:0c:e8:58:67:c9:eb:49:6b:14:93:3a:ac:68:5f:62:7e:27:c4:65:b6
Signer

Actual PE Digest

77:ad:df:c1:8b:5f:a4:a3:67:48:9f:ad:0c:e8:58:67:c9:eb:49:6b:14:93:3a:ac:68:5f:62:7e:27:c4:65:b6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\workspace\Build\icc\x32\__bin\Release\mfxplugin32_hw_full.pdb

Imports

dxva2

DXVAHD_CreateDevice
DXVA2CreateDirect3DDeviceManager9

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory

kernel32

DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
FreeLibrary
GetProcAddress
LoadLibraryExW
SetThreadErrorMode
WaitForSingleObject
Sleep
SetErrorMode
CloseHandle
GetOverlappedResult
WriteFile
CreateEventW
CreateFileA
SetThreadGroupAffinity
GetCurrentProcessorNumberEx
GetNumaNodeProcessorMaskEx
GetNumaHighestNodeNumber
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
CreateEventExW
ResetEvent
SwitchToThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
SystemTimeToFileTime
DeleteFileW
SetFilePointer
CreateFileW
GetFileAttributesExW
GetTempPathW
DeleteCriticalSection
FlushFileBuffers
ReadFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
FindClose
FindNextFileW
GetDiskFreeSpaceExW
SetEvent
PulseEvent
CreateEventA
GetVersionExW
GetModuleFileNameW
GetSystemInfo
GlobalMemoryStatusEx
FileTimeToSystemTime
LoadLibraryW
GetComputerNameW
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetModuleFileNameA
WaitForMultipleObjects
GetEnvironmentVariableA
LoadLibraryA
lstrcmpA
GetConsoleMode
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
ReadConsoleW
WriteConsoleW
GetTempFileNameW
RtlCaptureStackBackTrace
GetTimeZoneInformation
SetFilePointerEx
GetConsoleCP
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
LocalFree
MultiByteToWideChar
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetThreadLocale
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
VirtualProtect
VirtualFree
SetProcessAffinityMask
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
RtlUnwind
ExitThread
ResumeThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
SetConsoleCtrlHandler

user32

UnregisterClassW

ole32

StringFromGUID2
StringFromCLSID
CoTaskMemFree

advapi32

EventWrite
EventRegister
EventUnregister
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventEnabled

winmm

timeGetTime

setupapi

CM_Open_DevNode_Key
CM_Get_Device_ID_ListW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW

Exports

Exports

CreatePlugin
mfxCreateDecoderPlugin

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13.7MB - Virtual size: 13.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 81KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IPPDATA
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_o
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ccea29ab159671d31773c19ed69fcd2

Code Sign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dcCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

77:ad:df:c1:8b:5f:a4:a3:67:48:9f:ad:0c:e8:58:67:c9:eb:49:6b:14:93:3a:ac:68:5f:62:7e:27:c4:65:b6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dxva2

d3d11

dxgi

kernel32

user32

ole32

advapi32

winmm

setupapi

Exports

Exports

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

IPPCODE Size: 453KB - Virtual size: 453KB

.rdata Size: 13.7MB - Virtual size: 13.7MB

.data Size: 81KB - Virtual size: 113KB

.data1 Size: 224KB - Virtual size: 224KB

IPPDATA Size: 512B - Virtual size: 224B

.trace Size: 14KB - Virtual size: 14KB

_RDATA Size: 1KB - Virtual size: 1KB

.debug_o Size: 135KB - Virtual size: 135KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 125KB - Virtual size: 124KB

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

77:ad:df:c1:8b:5f:a4:a3:67:48:9f:ad:0c:e8:58:67:c9:eb:49:6b:14:93:3a:ac:68:5f:62:7e:27:c4:65:b6
Signer

.text
Size: 4.9MB - Virtual size: 4.9MB

IPPCODE
Size: 453KB - Virtual size: 453KB

.rdata
Size: 13.7MB - Virtual size: 13.7MB

.data
Size: 81KB - Virtual size: 113KB

.data1
Size: 224KB - Virtual size: 224KB

IPPDATA
Size: 512B - Virtual size: 224B

.trace
Size: 14KB - Virtual size: 14KB

_RDATA
Size: 1KB - Virtual size: 1KB

.debug_o
Size: 135KB - Virtual size: 135KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 125KB - Virtual size: 124KB