Public.zip
- SHA256 cb5f1feb2504a6e8b365cf13e434dd8c83ff1fca7cbee1a8b21ec0ecb5a2ba84
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nView.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
nView.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
nvTaskBar.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
nvTaskBar.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Public.zip
- Size 235KB
- Sample240104-p491bsgaej
- SHA256 cb5f1feb2504a6e8b365cf13e434dd8c83ff1fca7cbee1a8b21ec0ecb5a2ba84
- MD5 612190620682b4538fd44f68b276a316
- SHA1 a6ba6920495195340aee3e6536055f69fbd9ce3b
- SHA512 6f43f5148d3c0bf97fff890a84a1194925406f8320dbe6108a518767e2bab2cf72e8c5f51c2664ba5bbf12a7784361db4acb5b6b97e25756db4a9625468eab38
- SSDEEP 6144:VC8itN713tGoXrO/h6RBx5HsJebaXylEDY0I2mpQBxuaKrb:V5ixy/UBXCebaXylEDY0I2mfNn
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nView.dll
File Explorer
-
Public.zip.zip 235KB
-
nView.dll.dll 79KB
-
nvTaskBar.exe.exe 395KB
nView.dll
- IMPHASH ff98d730c7b4fbaa92b85279e37acb21
- SHA256 dd261a5db199b32414c33136aed44c3ebe2ae55f18991ae3dc341fc43a1ef7f4
- MD5 7ea17ffb336a7d8b24d62ba78151d264
- SHA1 10f30319eb0f7f939e2e872fdcef2f17d448c924
- SHA512 228a41ae99a82b9bc04e4cae7eb35c3b63588bcf454c9e3fa1f4b75bba7879ca9a9b5b4cb3c7ee8bbbeea8c65f31ad28a4b30c904fd78422ea0f2e44342739b8
- SSDEEP 1536:GvOLlrQmbhbuJMuOQKF03eXZlVhdKShDkZkNsWVcd5KtAc/2jo:GvmfVkMuc03eXZkOE5mAc/2jo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer
DMGetDesktopInfo
NVAutoStart
NVLoadDatabase
PMEnum
WMGetActiveAppSetting
WMGetGlobalPersistentSetting
WMGetSetting
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=29, id=261, version=30034,
count=15, id=260, version=30034,
count=17, id=259, version=30034,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=9, id=264, version=30153,
count=1, id=256, version=30153,
count=1, id=258, version=30153,
nvTaskBar.exe
- IMPHASH 223b579b60443779c59132313f69aa3b
- SHA256 f4b00f018ae7f68b116a9de0b8dba940af1f4aaa61e895d9c9312bc217ccb8ef
- MD5 485651be4f204cfd8a27256d4f8263b6
- SHA1 48b7bd592630fd660011405a313022616ecd4a02
- SHA512 8e4b73144d9ad9360e6eaba70d90a893e792773e3deb0fef6d03be05010dd41a3993c0f33ffd5db7d851b30f8676811af53a745a0a94f67c745c9746d34a5c86
- SSDEEP 6144:Hz2YaQrdcaJBTtO9c4u7QbZ0598T8RWdyQCLuAOWGbeD86:HiYaQrdTJBJO9lu7Qbe59tWdyQC6c186
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Sep 11, 2014
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2013 - Sep 23, 2024
Subject
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2014 - Sep 7, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
108712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Remove
ImageList_SetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControlsEx
dwmapi
DwmGetColorizationColor
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
gdiplus
GdipDeletePen
GdipCreatePen1
GdipAlloc
GdipDeleteBrush
GdipCreatePath
GdipCloneBrush
GdiplusStartup
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawLineI
GdipSetCompositingMode
GdipCreateFromHDC
GdipAddPathArcI
GdipClosePathFigure
GdipCreateSolidFill
GdiplusShutdown
GdipDeleteGraphics
GdipFree
GdipDeletePath
psapi
GetModuleBaseNameW
EnumProcessModules
uxtheme
CloseThemeData
DrawThemeBackground
OpenThemeData
IsThemeActive
GetThemeSysColor
kernel32
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
HeapDestroy
HeapCreate
GetFileType
WriteConsoleA
CreateFileW
SetStdHandle
SetFilePointer
GetLocaleInfoA
GetLocaleInfoW
WinExec
Sleep
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrcmpW
lstrlenW
CreateSemaphoreW
lstrcmpiW
GetTickCount
GetVersionExW
FreeLibrary
GetUserDefaultLangID
MultiByteToWideChar
CloseHandle
WaitForSingleObject
CreateEventW
GetProcAddress
GetModuleHandleW
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
DeleteCriticalSection
GetModuleHandleA
GetModuleFileNameA
GetProcessHeap
WriteFile
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapFree
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
GetStartupInfoA
GetCommandLineA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
RaiseException
LoadLibraryExW
SetLastError
GetSystemDirectoryW
LocalAlloc
ReleaseMutex
lstrcatW
GetFileAttributesW
GetCurrentProcess
IsWow64Process
ExpandEnvironmentStringsW
LoadLibraryW
GetLastError
GetCurrentThreadId
CreateMutexW
OutputDebugStringW
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
FormatMessageW
VirtualFree
LocalFree
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetCPInfo
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetStdHandle
CreateFileA
VirtualAlloc
user32
EnumWindows
FillRect
GetWindowPlacement
IntersectRect
GetMonitorInfoW
LoadStringW
CopyIcon
IsRectEmpty
IsHungAppWindow
GetClassNameW
GetClassLongW
IsIconic
GetWindow
PostQuitMessage
UnregisterClassW
EnumDisplayDevicesW
EnumDisplaySettingsW
EqualRect
DeregisterShellHookWindow
RegisterWindowMessageW
RegisterShellHookWindow
DispatchMessageW
GetMessageW
TranslateMessage
PostMessageW
IsWindowVisible
UpdateWindow
InvalidateRect
GetSysColor
ScreenToClient
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
RedrawWindow
GetParent
GetWindowThreadProcessId
FindWindowExW
SetForegroundWindow
GetForegroundWindow
ClientToScreen
PtInRect
GetWindowTextW
DestroyIcon
KillTimer
GetClassInfoExW
LoadIconW
LoadCursorW
GetSysColorBrush
LoadImageW
RegisterClassExW
RegisterClassW
DefWindowProcW
GetWindowLongW
CreateWindowExW
GetCursorPos
LoadMenuW
TrackPopupMenu
DestroyMenu
SetWindowLongW
DestroyWindow
GetSubMenu
CheckMenuItem
CascadeWindows
TileWindows
FindWindowW
ShowWindow
SendMessageW
GetWindowRect
SetTimer
SetWindowPos
MoveWindow
GetClientRect
CreatePopupMenu
MonitorFromPoint
InflateRect
gdi32
DeleteObject
CreateSolidBrush
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
DeregisterEventSource
ReportEventW
GetSecurityDescriptorSacl
SetSecurityInfo
RegisterEventSourceW
RegCloseKey
shell32
ShellExecuteW
SHAppBarMessage
ole32
CoCreateInstance
CoUninitialize
CoInitialize
nview
ord292
ord207
ord206
ord251
ord805
ord232
ord204
Name
.text
Size
274KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=149, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=258, id=1, productName=Unmarked objects,
count=69, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 build 21022, version=21022,