549255fbf51cae1fc07a1579580229bf
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2014-Dec-08 22:44:59 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\src\wix39r2\build\ship\x86\burn.pdb
|
| CompanyName | Intel |
| FileDescription | Intel Driver Update Utility |
| FileVersion | 2.2.0.2 |
| InternalName | setup |
| LegalCopyright | Copyright (c) Intel. All rights reserved. |
| OriginalFilename | Intel Driver Update Utility Installer.exe |
| ProductName | Intel Driver Update Utility |
| ProductVersion | 2.2.0.2 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA1
Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .wixburn |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Intel(R) Driver Update Utility
Issuer: Intel External Basic Issuing CA 3B |
| Safe | VirusTotal score: 0/66 (Scanned on 2017-11-28 13:32:28) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 2014-Dec-08 22:44:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 12.0 |
| SizeOfCode | 0x43a00 |
| SizeOfInitializedData | 0x25600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0002945F (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x45000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x70000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x4d8197 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.wixburn
.tls
.rsrc
.reloc
Imports
| ADVAPI32.dll |
OpenProcessToken
AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegCloseKey RegQueryValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceConfigW SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegOpenKeyExW |
|---|---|
| USER32.dll |
GetMessageW
PeekMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage TranslateMessage DefWindowProcW RegisterClassW UnregisterClassW CreateWindowExW MessageBoxW GetCursorPos GetWindowLongW SetWindowLongW DispatchMessageW LoadCursorW IsDialogMessageW MonitorFromPoint GetMonitorInfoW PostThreadMessageW MsgWaitForMultipleObjects LoadBitmapW |
| OLEAUT32.dll |
#2
#6 #8 #9 |
| GDI32.dll |
SelectObject
DeleteObject GetObjectW StretchBlt CreateCompatibleDC DeleteDC |
| SHELL32.dll |
ShellExecuteExW
SHGetFolderPathW CommandLineToArgvW |
| ole32.dll |
CoInitializeEx
CoUninitialize CoInitializeSecurity CLSIDFromProgID CoInitialize CoTaskMemFree CoCreateInstance StringFromGUID2 |
| KERNEL32.dll |
VerSetConditionMask
FreeLibrary GetProcAddress EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo lstrlenW GetModuleHandleExW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GetSystemWow64DirectoryW GetComputerNameW VerifyVersionInfoW GetVolumePathNameW CompareStringW GetDateFormatW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ExpandEnvironmentStringsW GetFileAttributesW ReadFile SetFilePointerEx CreateFileW CreateProcessW DuplicateHandle InterlockedExchange InterlockedCompareExchange LoadLibraryW lstrlenA RemoveDirectoryW CreateEventW GetCurrentProcessId ProcessIdToSessionId LocalFree OpenProcess GetProcessId WaitForSingleObject WriteFile ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread GetVersionExW SetFileAttributesW FindFirstFileW FindNextFileW SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA CompareStringA SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale GetModuleHandleW TlsFree TlsSetValue TlsGetValue GetLastError GetCurrentThreadId VirtualFree VirtualAlloc MoveFileExW CopyFileW DeleteFileW GetFileSizeEx GlobalFree GlobalAlloc GetModuleHandleA GetCurrentProcess HeapSetInformation GetFullPathNameW CreateDirectoryW TlsAlloc CloseHandle Sleep ReleaseMutex DeleteCriticalSection FindClose InitializeCriticalSection TerminateProcess InitializeCriticalSectionAndSpinCount GetTempFileNameW FormatMessageW GetLocalTime SetFilePointer FlushFileBuffers WriteConsoleW SetStdHandle LCMapStringW HeapSize HeapReAlloc GetConsoleMode GetConsoleCP OutputDebugStringW RtlUnwind LoadLibraryExW GetCPInfo GetOEMCP GetACP IsValidCodePage SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW HeapFree RaiseException SystemTimeToTzSpecificLocalTime GetTimeZoneInformation SystemTimeToFileTime HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW SetLastError EncodePointer DecodePointer ExitProcess MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW |
| Cabinet.dll |
#20
#23 #22 |
| CRYPT32.dll |
CertGetCertificateContextProperty
CryptHashPublicKeyInfo |
| msi.dll |
#238
#111 #173 #45 #205 #90 #141 #169 #70 #88 #190 #171 #118 #115 #125 #17 #137 #116 #8 |
| RPCRT4.dll |
UuidCreate
|
| WININET.dll |
InternetErrorDlg
InternetOpenW InternetConnectW InternetCloseHandle InternetReadFile InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetCrackUrlW |
| WINTRUST.dll |
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain WinVerifyTrust CryptCATAdminCalcHashFromFileHandle |
| VERSION.dll |
GetFileVersionInfoSizeW
GetFileVersionInfoW VerQueryValueW |
| SHLWAPI.dll |
PathCanonicalizeW
|
Delayed Imports
1
1 (#2)
1 (#3)
1 (#4)
1 (#5)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 2.2.0.2 |
| ProductVersion | 2.2.0.2 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Intel |
| FileDescription | Intel Driver Update Utility |
| FileVersion (#2) | 2.2.0.2 |
| InternalName | setup |
| LegalCopyright | Copyright (c) Intel. All rights reserved. |
| OriginalFilename | Intel Driver Update Utility Installer.exe |
| ProductName | Intel Driver Update Utility |
| ProductVersion (#2) | 2.2.0.2 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2014-Dec-08 22:44:59 |
| Version | 0.0 |
| SizeofData | 63 |
| AddressOfRawData | 0x5f840 |
| PointerToRawData | 0x5e640 |
| Referenced File | C:\src\wix39r2\build\ship\x86\burn.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2014-Dec-08 22:44:59 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x5f880 |
| PointerToRawData | 0x5e680 |
TLS Callbacks
| StartAddressOfRawData | 0x467000 |
|---|---|
| EndAddressOfRawData | 0x467008 |
| AddressOfIndex | 0x4632b0 |
| AddressOfCallbacks | 0x4454d4 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x462000 |
| SEHandlerTable | 0x45fb60 |
| SEHandlerCount | 3 |
RICH Header
| XOR Key | 0x2b39d818 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (20806) | 39 |
| ASM objects (20806) | 19 |
| C objects (20806) | 121 |
| C objects (VS2008 SP1 build 30729) | 5 |
| Imports (VS2008 SP1 build 30729) | 31 |
| Total imports | 326 |
| C++ objects (VS2013 build 21005) | 74 |
| Resource objects (VS2013 build 21005) | 1 |
| 151 | 2 |
| Linker (VS2013 build 21005) | 1 |