QualComm-FORCED-5x86-WiFi_10.0.0.274-drp.zip
- SHA256 537cf8957816b252ce04964dfef46485ca9c175b5f429ede17c6294514ff7739
Static task
static1
1 signatures
General
- Target QualComm-FORCED-5x86-WiFi_10.0.0.274-drp.zip
- Size 1.3MB
- Sample261002-ehp3xswtaz
- SHA256 537cf8957816b252ce04964dfef46485ca9c175b5f429ede17c6294514ff7739
- MD5 299f7929834874b594489f4098509f87
- SHA1 a46a3ef703d82eabe9b551709018bef41702274e
- SHA512 59fac344658df20278271a4c070bf8929a2f3a63820d4d7e77f8882dac232b25cc6b331a61ed379dbe1424c7c9e587779a931d0544d7437858e4a66cfefbc88e
- SSDEEP 24576:04JBBq+GPdicj7QsnFi7ORsKBVEB6V5AvP4JBBq+GPdicj7QsnFi7ORsKBVEB6Vd:0wLGPdiGViSPTEYV5AnwLGPdiGViSPTj
- TLSH T15065232307829C5C8E6475CCE61B71128AEAEFFD109ED3EE40F35B83A5E91119935D2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/QualComm/FORCED/5x86/WiFi_10.0.0.274/ar54169x.sys unpack001/QualComm/FORCED/5x86/WiFi_10.0.0.274/athw.sys
File Explorer
-
QualComm-FORCED-5x86-WiFi_10.0.0.274-drp.zip.zip 1.3MB
-
QualComm/FORCED/5x86/WiFi_10.0.0.274/ar54169x.sys.dll 2.1MB
-
QualComm/FORCED/5x86/WiFi_10.0.0.274/athw.sys.dll 2.1MB
-
QualComm/FORCED/5x86/WiFi_10.0.0.274/netathw.cat73KB
-
QualComm/FORCED/5x86/WiFi_10.0.0.274/netathw.inf283KB
-
QualComm/FORCED/5x86/WiFi_10.0.0.274/netathw.infdrp283KB
QualComm/FORCED/5x86/WiFi_10.0.0.274/ar54169x.sys
- IMPHASH b3ed91797f50bbb1eb4c7c6abb798b56
- SHA256 e2e3db52af4c905d0402837083de779e9effbaf1f610e78bbb15705695143de9
- MD5 0b4c07c070dfb37594d7fdfbf9b8fca1
- SHA1 522770bd6f83528c28c6c180897c65f1ac060c65
- SHA512 65e75a8ccf4d88688384a45a3b6ec62be776ad9b79329731a48b458d16bbe563d096b9a161bd5fcbb935020971a85c63a79f42044684eddca0034be40a3258d5
- SSDEEP 24576:NJ1ktGfd65YYEiK4vLT1+SKA9XP3W7h7ZmHkzyGV:NQ5YYEi1T1MZh7
- TLSH T1F8A58E83EBD53AF3F98A6530403B9F2776F9C25617029AD782C429E5AD327E068371C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
702608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
f:\STA10.0.0.274\sw\src\os\winxp\ath\NDIS5_Free\athw.pdb
ndis.sys
NdisMapFile
NdisCloseFile
NdisOpenFile
NdisMUnmapIoSpace
NdisMFreeMapRegisters
NdisFreeBufferPool
NdisFreePacketPool
NdisFreePacket
NdisWriteConfiguration
NdisCloseConfiguration
NdisOpenConfigurationKeyByName
NdisMGetDeviceProperty
NdisMDeregisterAdapterShutdownHandler
NdisMDeregisterInterrupt
NdisMRegisterAdapterShutdownHandler
NdisMRegisterInterrupt
NdisMSetAttributesEx
NdisReadConfiguration
NdisOpenConfiguration
NdisUnmapFile
NdisInitializeWrapper
NdisMCompleteBufferPhysicalMapping
NdisMStartBufferPhysicalMapping
NdisAllocateBuffer
NdisAllocatePacket
NdisMMapIoSpace
NdisMAllocateMapRegisters
NdisSetTimer
NdisMCancelTimer
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisMInitializeTimer
NdisReadNetworkAddress
NdisMQueryAdapterResources
NdisAllocateBufferPool
NdisAllocatePacketPool
NdisSystemProcessorCount
NdisWriteErrorLogEntry
NdisGetSystemUpTime
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisWritePciSlotInformation
NdisReadPciSlotInformation
NdisMFreeSharedMemory
NdisMAllocateSharedMemory
NdisMSleep
NdisMSynchronizeWithInterrupt
NdisMRegisterMiniport
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
IoFreeMdl
KeSetEvent
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
RtlUnicodeStringToAnsiString
RtlCharToInteger
ObfReferenceObject
memmove
RtlCopyUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlEqualUnicodeString
IoFreeIrp
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
IoAllocateIrp
IoUnregisterPlugPlayNotification
IoRegisterPlugPlayNotification
IoGetDeviceObjectPointer
RtlFreeAnsiString
RtlCompareMemory
KeQuerySystemTime
DbgPrint
ZwOpenKey
ZwDeleteKey
IoOpenDeviceRegistryKey
ZwClose
RtlInitUnicodeString
ZwCreateKey
ObfDereferenceObject
DbgPrintEx
memcpy
memset
_vsnprintf
KeBugCheckEx
hal
KfAcquireSpinLock
KeStallExecutionProcessor
READ_PORT_ULONG
WRITE_PORT_ULONG
WRITE_PORT_UCHAR
READ_PORT_UCHAR
READ_PORT_USHORT
KeQueryPerformanceCounter
KeGetCurrentIrql
KfReleaseSpinLock
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
584KB
Virtual Size
584KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=125, productName=VS2005 build 50727, version=50727,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=98, id=1, productName=Unmarked objects,
count=219, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
QualComm/FORCED/5x86/WiFi_10.0.0.274/athw.sys
- IMPHASH b3ed91797f50bbb1eb4c7c6abb798b56
- SHA256 e2e3db52af4c905d0402837083de779e9effbaf1f610e78bbb15705695143de9
- MD5 0b4c07c070dfb37594d7fdfbf9b8fca1
- SHA1 522770bd6f83528c28c6c180897c65f1ac060c65
- SHA512 65e75a8ccf4d88688384a45a3b6ec62be776ad9b79329731a48b458d16bbe563d096b9a161bd5fcbb935020971a85c63a79f42044684eddca0034be40a3258d5
- SSDEEP 24576:NJ1ktGfd65YYEiK4vLT1+SKA9XP3W7h7ZmHkzyGV:NQ5YYEi1T1MZh7
- TLSH T1F8A58E83EBD53AF3F98A6530403B9F2776F9C25617029AD782C429E5AD327E068371C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
702608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
f:\STA10.0.0.274\sw\src\os\winxp\ath\NDIS5_Free\athw.pdb
ndis.sys
NdisMapFile
NdisCloseFile
NdisOpenFile
NdisMUnmapIoSpace
NdisMFreeMapRegisters
NdisFreeBufferPool
NdisFreePacketPool
NdisFreePacket
NdisWriteConfiguration
NdisCloseConfiguration
NdisOpenConfigurationKeyByName
NdisMGetDeviceProperty
NdisMDeregisterAdapterShutdownHandler
NdisMDeregisterInterrupt
NdisMRegisterAdapterShutdownHandler
NdisMRegisterInterrupt
NdisMSetAttributesEx
NdisReadConfiguration
NdisOpenConfiguration
NdisUnmapFile
NdisInitializeWrapper
NdisMCompleteBufferPhysicalMapping
NdisMStartBufferPhysicalMapping
NdisAllocateBuffer
NdisAllocatePacket
NdisMMapIoSpace
NdisMAllocateMapRegisters
NdisSetTimer
NdisMCancelTimer
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisMInitializeTimer
NdisReadNetworkAddress
NdisMQueryAdapterResources
NdisAllocateBufferPool
NdisAllocatePacketPool
NdisSystemProcessorCount
NdisWriteErrorLogEntry
NdisGetSystemUpTime
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisWritePciSlotInformation
NdisReadPciSlotInformation
NdisMFreeSharedMemory
NdisMAllocateSharedMemory
NdisMSleep
NdisMSynchronizeWithInterrupt
NdisMRegisterMiniport
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
IoFreeMdl
KeSetEvent
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
RtlUnicodeStringToAnsiString
RtlCharToInteger
ObfReferenceObject
memmove
RtlCopyUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlEqualUnicodeString
IoFreeIrp
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
IoAllocateIrp
IoUnregisterPlugPlayNotification
IoRegisterPlugPlayNotification
IoGetDeviceObjectPointer
RtlFreeAnsiString
RtlCompareMemory
KeQuerySystemTime
DbgPrint
ZwOpenKey
ZwDeleteKey
IoOpenDeviceRegistryKey
ZwClose
RtlInitUnicodeString
ZwCreateKey
ObfDereferenceObject
DbgPrintEx
memcpy
memset
_vsnprintf
KeBugCheckEx
hal
KfAcquireSpinLock
KeStallExecutionProcessor
READ_PORT_ULONG
WRITE_PORT_ULONG
WRITE_PORT_UCHAR
READ_PORT_UCHAR
READ_PORT_USHORT
KeQueryPerformanceCounter
KeGetCurrentIrql
KfReleaseSpinLock
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
584KB
Virtual Size
584KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=125, productName=VS2005 build 50727, version=50727,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=98, id=1, productName=Unmarked objects,
count=219, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
QualComm/FORCED/5x86/WiFi_10.0.0.274/netathw.cat
- SHA256 a9294438bcea369bc7d575d8c2d50d8a1e96f697a93c0e172d1fe573af1af24d
- MD5 eed8358acb37e3ace0feb242aeba1cc8
- SHA1 f9301b55f267f84936008d98ba1baf6d4c359306
- SHA512 22477568aa481f682263b1de5a812fcac9409633be90f3c3c6be85db5c3d300d303dc0ac09e35fbc2ba47ebf1837472c3d59759789c5b0b9cefbaffc1f71b71f
- SSDEEP 192:lOL9mMHQySJB4/u9LEFgCeYnL89Ra1c95aBE7pyp//9xsmdeqb4vbtCTuNyx7P3W:s7nL89Rcc95YFYW24C+3Ef5dpBjhj
- TLSH T1AF730B7E48C90ADAF1778D31A1F55A9778D13AC33C24390D096EDB219981BC2EEF116E
- MD5 SHA1 SHA512 SSDEEP TLSH
QualComm/FORCED/5x86/WiFi_10.0.0.274/netathw.inf
- SHA256 e37fa17e4b570981c86b0a15fe8c72a2011ecba4056143e423a4139702f5c824
- MD5 27cd6de113b03fc5b493d5497e8a8346
- SHA1 d8eaea36adb2146075d17e6c91bc572e48346556
- SHA512 936aff87a4f8f936b707a94d9f2dbc22270d88ae89c715195676c69eb070b76ce5be343e750c659de0a66207ddf44ff1a929feb0a899bb6c18a446082529ef04
- SSDEEP 3072:XS3PtSVQt2CvYa6aGJSi1BjahTq7+gEIiyOLVr3B/1:OQlSCEIiyOLVr3Bd
- TLSH T145545496F5841336D247A242FDE2ED7384ECA80420852A4835DCBAED13DE95D53E8FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
QualComm/FORCED/5x86/WiFi_10.0.0.274/netathw.infdrp
- SHA256 39b0fa0d6845019ee76c87da3a0a8de591243442f51b275760e2c12b4d73e305
- MD5 68acf30c5239634b7f4ac4bce01e5f06
- SHA1 c9a18adb2efbd5fd28488723ae16bd05a386b274
- SHA512 11dbf32ea2f32b72231e5c2d956395a7b60b3b6e6286b223b5f3e50e3dc52262e486291162a79d22ac195a494940ae1aa5bba6b2dee3fc8f0dcf2d89ce8dce3f
- SSDEEP 3072:rg3PtSVQt2CvYa6aGJSi1BjahTq7+gEIiyOLVr3B/1:EQlSCEIiyOLVr3Bd
- TLSH T162545496F5841336D247A242FDE2ED7384ECA80420852A4835DCBAED13DE95D53E8FB9
- MD5 SHA1 SHA512 SSDEEP TLSH