xpu.zip
- SHA256 09cf15421f83698ac1a455e5a8561a91565b344faa4e6ffb31fd1e98d8fac540
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
xpu/drvInst64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
xpu/drvInst64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
xpu/drvInst64.exe.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
xpu/drvInst64.exe.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
xpu/newdev.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
xpu/newdev.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target xpu.zip
- Size 1.0MB
- Sample260907-pgaxqatzft
- SHA256 09cf15421f83698ac1a455e5a8561a91565b344faa4e6ffb31fd1e98d8fac540
- MD5 7710ba743ec1631d28a476fbf33141a6
- SHA1 842521f9b3fae7da1dfba06c3f2ffa6f5913defa
- SHA512 9d4ef41b8be7d5e0b9cc866a6ccc9e95d66187a83b596774af67be47cc840115bcc2a8980573db97f8d78377d66ff0aba9378b245947b9aba4f23326686fef33
- SSDEEP 24576:TeO59zeXMRMsqFTjwyrt/t/03oQ+gBJaPd742QoTlPPP:Tn9zQTjp/ts37BJaPdM2QoT5n
- TLSH T1272533BAE5AFE9C4448761BD0350F44FFBFF22A9C49AA48107C508BD6195E7434F8E91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/xpu/newdev.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xpu/newdev.dll
File Explorer
-
xpu.zip.zip 1.0MB
-
xpu/drvInst64.exe.exe 531KB
-
xpu/drvInst64.exe.ini792KB
-
xpu/newdev.dll.dll 134KB
xpu/drvInst64.exe
- IMPHASH 37fee614633eadfc6fc9136388d2cea3
- SHA256 74bb2a8b54149c9412e9d387d37b728336f573cda83a328088eec6443c52928a
- MD5 1bc32c5d4694f30ece54fe3b5daf2725
- SHA1 5c3430d7eecbd7a7d8d317fad3bb6ae420db75dd
- SHA512 e717d684a29828bc2ae2828798d3f05ad12d68da612e51521e1a8cdcf5e48bb8483b90cf078b6a2c9d36f68e13858af6686fa038c3ce86765932bf6eee12ab12
- SSDEEP 6144:0sBGy5XeE8G2uwunDIC3QQrmbky4ivjlVD6uFI9dhGdibp0hpVMqKHdbRW/5Tg:JneE8SwuDFBrmbk9iZV6yucIpGH3cFQg
- TLSH T124C48C96F29154E9D06B813888924B02E771BC250720DBDB27ECE6765F37AD21F39F60
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a2:a3:7e:b0:d4:ab:5e:6f:7a:d1:c3:d9:d8:f6:52:ab:27:5a:fc:9c:dd:3a:cb:63:64:a3:15:74:79:94:6e:51
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=6610117,CN=Broadcom Inc,O=Broadcom Inc,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Feb 20, 2025
SERIALNUMBER=6610117,CN=Broadcom Inc,O=Broadcom Inc,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=6610117,CN=Broadcom Inc,O=Broadcom Inc,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=6610117,CN=Broadcom Inc,O=Broadcom Inc,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
06:40:02:5b:ff:0c:48:97:32:99:d4:63:20:83:c3:7b
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 28, 2024 - Mar 30, 2027
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
179296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\build\ob\bora-24583834\bora\build\build\drvInst64\release\win64\drvInst64.pdb
kernel32
GetSystemDirectoryW
FreeLibrary
CopyFileW
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
GetModuleFileNameW
LoadLibraryExW
MoveFileExW
WriteConsoleW
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleExW
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetACP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetFileType
SetStdHandle
FileTimeToSystemTime
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapReAlloc
SetEndOfFile
ReadFile
ReadConsoleW
SetFilePointerEx
GetCPInfo
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
GetFileSizeEx
HeapSize
RaiseException
RtlUnwindEx
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlPcToFileHeader
FileTimeToLocalFileTime
SetLastError
GetTempPathW
FindFirstFileExW
SetEnvironmentVariableW
GetProcAddress
GetModuleHandleW
LocalFree
LocalAlloc
Sleep
FindClose
GetLastError
GetStartupInfoW
OutputDebugStringA
CreateEventW
newdev
UpdateDriverForPlugAndPlayDevicesW
advapi32
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
setupapi
SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyA
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetINFClassW
SetupDiCallClassInstaller
ws2_32
WSCDeinstallProvider
WSCInstallProvider
Name
.text
Size
295KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=257, version=28900,
count=216, id=1, productName=Unmarked objects,
count=7, id=259, version=30795,
count=204, id=261, version=30795,
count=12, id=260, version=30795,
count=47, id=261, version=32420,
count=18, id=260, version=32420,
count=10, id=259, version=32420,
count=67, id=260, version=30145,
count=6, id=261, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
xpu/drvInst64.exe.ini
- SHA256 764d49aabd24ca69eb3f23594e52b38cdafd1391fbb9fdef508cb1b0ded814bf
- MD5 fd692ecf1e71d140bba0c833c04e63a9
- SHA1 d9b538d7b25b0c6c693e36de9dfdc360e67cd32f
- SHA512 590c99a564d3829908ef4abaf471b8f62bcb99342d60c75db958807ede04f887af00464adece241a6e01ad92418b67041c4619717b10b36b2428859fb553ca4e
- SSDEEP 24576:x/f8XEp5izZrQmGkAf8btMV+83xRqQIrjewpynp7uxsA:xMs5MGmGkAfk5uRqluwgwsA
- TLSH T1DC0512DBD1900CCE46E894EB3D5628B05867B9331E2E0BD8A2194F5DBCD520297BB3DD
- MD5 SHA1 SHA512 SSDEEP TLSH
xpu/newdev.dll
- IMPHASH 801e7c1b07288ddab08ea278161f0a93
- SHA256 499386ffca9317e5ebad9db4b070c2f25ab151839c44a932fcb03f257fe0c974
- MD5 683fefcf9de626b9029a19fbbcb950ab
- SHA1 91dd9981ab192ed626086f1de8a47937b63e8c7e
- SHA512 1ea8305754b13858ec01b24ee0470e12890dbe85f2760d70b11bb64f52e75f1d955aea5fe08eb186775f62cba6e12db5d357745055593f0cc39c2ecc2c96d987
- SSDEEP 3072:N7jcblcS1G4bTD08n2VF8CIU1o6gyVMqNAe4Z:NHcJccGgMq3CIEowNAd
- TLSH T174D35B4B77B500BBE0768239C5534A06D372B8155B60ABDF07B4465A2F237E29D3EB32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
GetCurrentProcess
lstrlenW
GetModuleFileNameW
CreateMutexA
WaitForSingleObject
lstrcatA
GetLastError
DisableThreadLibraryCalls
lstrcatW
CloseHandle
LoadLibraryW
CreateThread
GetProcAddress
ExitProcess
GetModuleHandleW
GetConsoleWindow
GetComputerNameA
WriteConsoleW
SetEndOfFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
GetModuleHandleExW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LCMapStringW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
CreateFileW
HeapSize
HeapReAlloc
user32
EnumWindows
ShowWindow
DeviceInternetSettingUiW
DiInstallDevice
DiInstallDriverA
DiInstallDriverW
DiRollbackDriver
DiShowUpdateDevice
DiShowUpdateDriver
DiUninstallDevice
DiUninstallDriverA
DiUninstallDriverW
GetInternetPolicies
InstallLegacyDeviceDriver
InstallNewDevice
InstallSelectedDriver
InstallWindowsUpdateDriver
InstallWindowsUpdateDriverEx
InstallWindowsUpdateDrivers
QueryWindowsUpdateDriverStatus
SetDriverPackageRestorePoint
SetInternetPolicies
UpdateDriverForPlugAndPlayDevicesA
UpdateDriverForPlugAndPlayDevicesW
pDiDoDeviceInstallAsAdmin
pDiDoNullDriverInstall
pDiRunFinishInstallOperations
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=151, id=261, version=33138,
count=12, id=260, version=33138,
count=6, id=259, version=33138,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=36, id=261, version=34321,
count=5, id=257, version=33138,
count=105, id=1, productName=Unmarked objects,
count=1, id=265, version=34435,
count=1, id=256, version=34435,
count=1, id=258, version=34435,