HidRegisterMinidriver
Static task
static1
Behavioral task
behavioral1
Sample
2030b998645eaef0aeb649657f049aa0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2030b998645eaef0aeb649657f049aa0N.dll
Resource
win10v2004-20240802-en
General
-
Target
2030b998645eaef0aeb649657f049aa0N.exe
-
Size
96KB
-
MD5
2030b998645eaef0aeb649657f049aa0
-
SHA1
44013e1b04ba7a19e801ca750a6293a86d3df026
-
SHA256
290a81688a5356d4f1326a90d1cd4bcea82d7d323064d9a81c8fc3da14f45909
-
SHA512
3feb6c86304ca0092781116a8526a661fbfc89bb738ccec9690bf761d5d963614540669db7fe46e35552bea4ca19020f1c70e91773a53a76286724924a465502
-
SSDEEP
768:IsOtR6B1s4kcYkUrU2INNzxG9+W2fv/NoiGbnMmI:3Ot863cYq3jVG9+1vCzbnMmI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2030b998645eaef0aeb649657f049aa0N.exe
Files
-
2030b998645eaef0aeb649657f049aa0N.exe.dll windows:4 windows x86 arch:x86
1c35b027e23aec3cc104ea1ce23a726f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
hal
KeAcquireSpinLock
KeReleaseSpinLock
hidparse.sys
HidP_FreeCollectionDescription
HidP_GetCollectionDescription
kernel32
CloseHandle
CreateEventA
CreateThread
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapReAlloc
IsBadStringPtrW
SetEvent
WaitForSingleObject
ntdll
_vsnprintf
ntoskrnl.exe
ObfReferenceObject
ExAllocatePool
ExFreePool
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IoCallDriver
IoCompleteRequest
IoCreateDevice
IoDeleteDevice
IoDetachDevice
IoInvalidateDeviceRelations
IoRegisterDeviceInterface
IoReleaseCancelSpinLock
IoSetDeviceInterfaceState
KeInitializeEvent
KeWaitForSingleObject
MmMapLockedPagesSpecifyCache
RtlFreeUnicodeString
RtlInitUnicodeString
_wcsnicmp
memcpy
memset
wcscpy
wcslen
wcsncmp
wcsrchr
wcsstr
ucrtbase
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
calloc
free
fwrite
getenv
malloc
memmove
strchr
strcmp
strcspn
strlen
user32
GetProcessWindowStation
win32u
NtUserCallHwndParam
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rodata Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 160B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ