Public[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Public.zip
Size

235KB
MD5

612190620682b4538fd44f68b276a316
SHA1

a6ba6920495195340aee3e6536055f69fbd9ce3b
SHA256

cb5f1feb2504a6e8b365cf13e434dd8c83ff1fca7cbee1a8b21ec0ecb5a2ba84
SHA512

6f43f5148d3c0bf97fff890a84a1194925406f8320dbe6108a518767e2bab2cf72e8c5f51c2664ba5bbf12a7784361db4acb5b6b97e25756db4a9625468eab38
SSDEEP

6144:VC8itN713tGoXrO/h6RBx5HsJebaXylEDY0I2mpQBxuaKrb:V5ixy/UBXCebaXylEDY0I2mfNn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/nView.dll

Files

Public.zip
.zip
nView.dll
.dll windows:6 windows x86 arch:x86

ff98d730c7b4fbaa92b85279e37acb21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer

Exports

Exports

DMGetDesktopInfo
NVAutoStart
NVLoadDatabase
PMEnum
WMGetActiveAppSetting
WMGetGlobalPersistentSetting
WMGetSetting

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nvTaskBar.exe
.exe windows:5 windows x86 arch:x86

223b579b60443779c59132313f69aa3b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/09/2014, 00:00

Not After

07/09/2015, 23:59

Subject

CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e
Signer

Actual PE Digest

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Draw
ImageList_ReplaceIcon
ImageList_Remove
ImageList_SetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControlsEx

dwmapi

DwmGetColorizationColor
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

gdiplus

GdipDeletePen
GdipCreatePen1
GdipAlloc
GdipDeleteBrush
GdipCreatePath
GdipCloneBrush
GdiplusStartup
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawLineI
GdipSetCompositingMode
GdipCreateFromHDC
GdipAddPathArcI
GdipClosePathFigure
GdipCreateSolidFill
GdiplusShutdown
GdipDeleteGraphics
GdipFree
GdipDeletePath

psapi

GetModuleBaseNameW
EnumProcessModules

uxtheme

CloseThemeData
DrawThemeBackground
OpenThemeData
IsThemeActive
GetThemeSysColor

kernel32

SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
HeapDestroy
HeapCreate
GetFileType
WriteConsoleA
CreateFileW
SetStdHandle
SetFilePointer
GetLocaleInfoA
GetLocaleInfoW
WinExec
Sleep
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrcmpW
lstrlenW
CreateSemaphoreW
lstrcmpiW
GetTickCount
GetVersionExW
FreeLibrary
GetUserDefaultLangID
MultiByteToWideChar
CloseHandle
WaitForSingleObject
CreateEventW
GetProcAddress
GetModuleHandleW
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
DeleteCriticalSection
GetModuleHandleA
GetModuleFileNameA
GetProcessHeap
WriteFile
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapFree
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
GetStartupInfoA
GetCommandLineA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
RaiseException
LoadLibraryExW
SetLastError
GetSystemDirectoryW
LocalAlloc
ReleaseMutex
lstrcatW
GetFileAttributesW
GetCurrentProcess
IsWow64Process
ExpandEnvironmentStringsW
LoadLibraryW
GetLastError
GetCurrentThreadId
CreateMutexW
OutputDebugStringW
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
FormatMessageW
VirtualFree
LocalFree
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetCPInfo
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetStdHandle
CreateFileA
VirtualAlloc

user32

EnumWindows
FillRect
GetWindowPlacement
IntersectRect
GetMonitorInfoW
LoadStringW
CopyIcon
IsRectEmpty
IsHungAppWindow
GetClassNameW
GetClassLongW
IsIconic
GetWindow
PostQuitMessage
UnregisterClassW
EnumDisplayDevicesW
EnumDisplaySettingsW
EqualRect
DeregisterShellHookWindow
RegisterWindowMessageW
RegisterShellHookWindow
DispatchMessageW
GetMessageW
TranslateMessage
PostMessageW
IsWindowVisible
UpdateWindow
InvalidateRect
GetSysColor
ScreenToClient
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
RedrawWindow
GetParent
GetWindowThreadProcessId
FindWindowExW
SetForegroundWindow
GetForegroundWindow
ClientToScreen
PtInRect
GetWindowTextW
DestroyIcon
KillTimer
GetClassInfoExW
LoadIconW
LoadCursorW
GetSysColorBrush
LoadImageW
RegisterClassExW
RegisterClassW
DefWindowProcW
GetWindowLongW
CreateWindowExW
GetCursorPos
LoadMenuW
TrackPopupMenu
DestroyMenu
SetWindowLongW
DestroyWindow
GetSubMenu
CheckMenuItem
CascadeWindows
TileWindows
FindWindowW
ShowWindow
SendMessageW
GetWindowRect
SetTimer
SetWindowPos
MoveWindow
GetClientRect
CreatePopupMenu
MonitorFromPoint
InflateRect

gdi32

DeleteObject
CreateSolidBrush

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
DeregisterEventSource
ReportEventW
GetSecurityDescriptorSacl
SetSecurityInfo
RegisterEventSourceW
RegCloseKey

shell32

ShellExecuteW
SHAppBarMessage

ole32

CoCreateInstance
CoUninitialize
CoInitialize

nview

ord292
ord207
ord206
ord251
ord805
ord232
ord204

Sections

.text
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff98d730c7b4fbaa92b85279e37acb21

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 2KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

223b579b60443779c59132313f69aa3b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2eSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

dwmapi

gdiplus

psapi

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

nview

Sections

.text Size: 274KB - Virtual size: 273KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e
Signer

.text
Size: 274KB - Virtual size: 273KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 11KB - Virtual size: 10KB