Gfxv4_0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Gfxv4_0.exe
Size

932KB
MD5

c666a5352bcf8be7fe3730449acd26e6
SHA1

f7446822af99766ea0c97a591ccbe636fc35f3a2
SHA256

f7f10d5dde6421e3beee8e7a65b9eb792f911b782a0937a6947d3c195bb21adb
SHA512

1e58da2f3572286c2536499989ca81695a880684ba9657c59a56de8cc578c1bb9d89e8e2cb4bf162707bfa359a73e341cb3118aea3ce1a48fe41716673a1aee8
SSDEEP

24576:D7fbq1fplVaoFr5D2RNs+f+tgCazU540/VYRl33cmzsr/Gu0oaM:qplUoFr5/tgCazU540/VYRl3Vsr/GK

Score

1^/10

Malware Config

Signatures

Files

Gfxv4_0.exe
.exe windows x64

Code Sign

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:6a:f7:a3:ef:32:d0:b6:70:54:22:37:91:5b:7e:e0:e0:92:67:7e:e9:cc:14:28:fb:61:93:c1:82:e7:c3:47
Signer

Actual PE Digest

6a:6a:f7:a3:ef:32:d0:b6:70:54:22:37:91:5b:7e:e0:e0:92:67:7e:e9:cc:14:28:fb:61:93:c1:82:e7:c3:47

Digest Algorithm

sha256

PE Digest Matches

true

fd:d0:07:bb:68:e9:a5:44:b1:47:a7:d9:5d:24:bb:8d:38:e8:f5:82
Signer

Actual PE Digest

fd:d0:07:bb:68:e9:a5:44:b1:47:a7:d9:5d:24:bb:8d:38:e8:f5:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 790KB - Virtual size: 789KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5Certificate

Extended Key Usages

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

6a:6a:f7:a3:ef:32:d0:b6:70:54:22:37:91:5b:7e:e0:e0:92:67:7e:e9:cc:14:28:fb:61:93:c1:82:e7:c3:47Signer

fd:d0:07:bb:68:e9:a5:44:b1:47:a7:d9:5d:24:bb:8d:38:e8:f5:82Signer

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 790KB - Virtual size: 789KB

.rsrc Size: 127KB - Virtual size: 126KB

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5
Certificate

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

6a:6a:f7:a3:ef:32:d0:b6:70:54:22:37:91:5b:7e:e0:e0:92:67:7e:e9:cc:14:28:fb:61:93:c1:82:e7:c3:47
Signer

fd:d0:07:bb:68:e9:a5:44:b1:47:a7:d9:5d:24:bb:8d:38:e8:f5:82
Signer

.text
Size: 790KB - Virtual size: 789KB

.rsrc
Size: 127KB - Virtual size: 126KB