MediaTek-10x64-79xx_3[.]03[.]01[.]0508[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MediaTek-10x64-79xx_3.03.01.0508.zip
Size

6.7MB
MD5

03f8b8af8db8886461e66aa71efe56a0
SHA1

798b4dec5c971a30a3b3eaef77c74407512a6956
SHA256

dbc01618254e0cd36933e917c4e24f64e8a4ad0e493fb88fd3832810f4de383d
SHA512

50f34198633e83ae8e17b394fd1a009a3ccca1f1d86c72b0e7b9a0c291783d0bb75ec5a49641f6a69a5d63ac9ddf8bd4763e6aa1fba4ae20ba217710933b5ff4
SSDEEP

98304:XwRKXlSxBO6uo2DvHpv/1xw0/+Vs/JjUiOEQ3n9XM4HnjUXf1ZEoD7Mhqcu/MtbX:SKSBgo2DFZWVs/lONe1ZQw0tT7BF

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkihvx.dll
unpack001/MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl6ex.sys

Files

MediaTek-10x64-79xx_3.03.01.0508.zip
.zip
MediaTek/FORCED/10x64/79xx_3.03.01.0508/WIFI_MT7902_patch_mcu_1_1_hdr.bin
MediaTek/FORCED/10x64/79xx_3.03.01.0508/WIFI_MT7922_patch_mcu_1_1_hdr.bin
MediaTek/FORCED/10x64/79xx_3.03.01.0508/WIFI_MT7961_patch_mcu_1_2_hdr.bin
MediaTek/FORCED/10x64/79xx_3.03.01.0508/WIFI_RAM_CODE_MT7902_1.bin
MediaTek/FORCED/10x64/79xx_3.03.01.0508/WIFI_RAM_CODE_MT7922_1.bin
MediaTek/FORCED/10x64/79xx_3.03.01.0508/WIFI_RAM_CODE_MT7961_1.bin
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkihvx.dll
.dll windows:6 windows x64 arch:x64

6f7183b5905f8d3fe98816cbee639bdc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

N:\MtK22385-Project\TOOL_IHV\seattle\mtkihv\x64\Release\mtkihvx.pdb

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSection
CreateThread
WriteConsoleW
DeviceIoControl
OutputDebugStringA
DebugBreak
CreateFileA
WaitForSingleObject
WTSGetActiveConsoleSessionId
Sleep
ResetEvent
SetEvent
CreateEventA
LeaveCriticalSection
EnterCriticalSection
GetLastError
WaitForMultipleObjects
CloseHandle
CreateFileW
OutputDebugStringW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
WriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetCurrentThread
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
SetConsoleCtrlHandler
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
RtlUnwind

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegEnumKeyExA
RegCloseKey
OpenEventLogA
NotifyChangeEventLog
TraceMessage

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysAllocString
SysFreeString

Exports

Exports

DllMain
Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService

Sections

.text
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl1.dat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl1_2.dat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl2.dat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl2_2.dat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl3.dat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl3_2.dat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl6ex.cat
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl6ex.inf
MediaTek/FORCED/10x64/79xx_3.03.01.0508/mtkwl6ex.sys
.sys windows:10 windows x64 arch:x64

2edf7cc74c4f7099fbd10d18780ddf3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\worktmp\7072\codebase\wlan_driver\seattle\wifi_driver\windows\PLATFORM\Ndis6\x64\mtkwl6ex.pdb

Imports

ntoskrnl.exe

ZwCreateFile
RtlAppendUnicodeToString
ExInterlockedRemoveHeadList
RtlGetVersion
IoGetDmaAdapter
ZwSetValueKey
ZwCreateKey
MmBuildMdlForNonPagedPool
RtlAnsiStringToUnicodeString
ExInterlockedInsertTailList
_vsnwprintf
_vsnprintf
IoReleaseCancelSpinLock
IofCompleteRequest
MmMapLockedPagesSpecifyCache
strncmp
KfRaiseIrql
KeLowerIrql
ObfDereferenceObject
ObReferenceObjectByHandle
PsTerminateSystemThread
PsCreateSystemThread
KeWaitForSingleObject
KeSetPriorityThread
KeFlushQueuedDpcs
PsGetCurrentThreadId
__chkstk
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlInitUnicodeString
RtlTimeToTimeFields
ExSystemTimeToLocalTime
swprintf
KeClearEvent
KeSetEvent
strchr
__C_specific_handler
strncpy_s
strcmp
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
IoBuildDeviceIoControlRequest
IofCallDriver
IoWMIOpenBlock
IoWMIQueryAllData
IoWMIExecuteMethod
IoWMISetNotificationCallback
KeInitializeSpinLock
ZwWriteFile
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeGetCurrentIrql
ZwQueryValueKey
ZwOpenKey
ZwClose
ExFreePoolWithTag
ExAllocatePoolWithTag
KeInitializeEvent
RtlCopyUnicodeString
RtlUnicodeStringToAnsiString
isxdigit
IoWMIRegistrationControl
MmGetSystemRoutineAddress

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

ndis.sys

NdisResetEvent
NdisSetEvent
NdisInitializeEvent
NdisAllocateMemoryWithTagPriority
NdisReleaseReadWriteLock
NdisAcquireReadWriteLock
NdisMSynchronizeWithInterruptEx
NdisMAllocateNetBufferSGList
NdisAllocateMemoryWithTag
NdisQueueIoWorkItem
NdisMSleep
NdisAllocateIoWorkItem
NdisFreeMdl
NdisAllocateMdl
NdisFreeNetBufferPool
NdisRetreatNetBufferListDataStart
NdisAllocateNetBufferList
NdisMIndicateStatusEx
NdisMDeregisterWdiMiniportDriver
NdisMRegisterWdiMiniportDriver
NdisMDeregisterScatterGatherDma
NdisMRegisterScatterGatherDma
NdisAllocateTimerObject
NdisMUnmapIoSpace
NdisMMapIoSpace
NdisMSetBusData
NdisMGetBusData
NdisMDeregisterInterruptEx
NdisMRegisterInterruptEx
NdisGetVersion
NdisGetDeviceReservedExtension
NdisDeregisterDeviceEx
NdisRegisterDeviceEx
NdisUnmapFile
NdisCloseFile
NdisWriteConfiguration
NdisMFreeNetBufferSGList
NdisFreeIoWorkItem
NdisFreeTimerObject
NdisSetTimerObject
NdisMGetDeviceProperty
NdisWaitEvent
NdisInitializeReadWriteLock
NdisReadConfiguration
NdisCloseConfiguration
NdisFreeMemory
NdisOpenFile
NdisMapFile
NdisInitializeString
NdisOpenConfigurationEx
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisAllocateNetBufferAndNetBufferList
NdisFreeNetBufferList
NdisAllocateNetBufferPool
NdisCancelTimerObject

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

cng.sys

BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptCreateHash
BCryptFinishHash
BCryptHashData
BCryptCloseAlgorithmProvider

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f7183b5905f8d3fe98816cbee639bdc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 407KB - Virtual size: 406KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 3KB - Virtual size: 10KB

.pdata Size: 19KB - Virtual size: 18KB

_RDATA Size: 512B - Virtual size: 384B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

2edf7cc74c4f7099fbd10d18780ddf3c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

wdfldr.sys

cng.sys

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 85KB - Virtual size: 85KB

.data Size: 44KB - Virtual size: 63KB

.pdata Size: 25KB - Virtual size: 24KB

PAGE Size: 2KB - Virtual size: 1KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 407KB - Virtual size: 406KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 3KB - Virtual size: 10KB

.pdata
Size: 19KB - Virtual size: 18KB

_RDATA
Size: 512B - Virtual size: 384B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 85KB - Virtual size: 85KB

.data
Size: 44KB - Virtual size: 63KB

.pdata
Size: 25KB - Virtual size: 24KB

PAGE
Size: 2KB - Virtual size: 1KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 4KB - Virtual size: 3KB