nvTaskBar[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

nvTaskBar.exe
Size

395KB
MD5

485651be4f204cfd8a27256d4f8263b6
SHA1

48b7bd592630fd660011405a313022616ecd4a02
SHA256

f4b00f018ae7f68b116a9de0b8dba940af1f4aaa61e895d9c9312bc217ccb8ef
SHA512

8e4b73144d9ad9360e6eaba70d90a893e792773e3deb0fef6d03be05010dd41a3993c0f33ffd5db7d851b30f8676811af53a745a0a94f67c745c9746d34a5c86
SSDEEP

6144:Hz2YaQrdcaJBTtO9c4u7QbZ0598T8RWdyQCLuAOWGbeD86:HiYaQrdTJBJO9lu7Qbe59tWdyQC6c186

Score

1^/10

Malware Config

Signatures

Files

nvTaskBar.exe
.exe windows:5 windows x86 arch:x86

223b579b60443779c59132313f69aa3b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/09/2014, 00:00

Not After

07/09/2015, 23:59

Subject

CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e
Signer

Actual PE Digest

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Draw
ImageList_ReplaceIcon
ImageList_Remove
ImageList_SetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControlsEx

dwmapi

DwmGetColorizationColor
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

gdiplus

GdipDeletePen
GdipCreatePen1
GdipAlloc
GdipDeleteBrush
GdipCreatePath
GdipCloneBrush
GdiplusStartup
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawLineI
GdipSetCompositingMode
GdipCreateFromHDC
GdipAddPathArcI
GdipClosePathFigure
GdipCreateSolidFill
GdiplusShutdown
GdipDeleteGraphics
GdipFree
GdipDeletePath

psapi

GetModuleBaseNameW
EnumProcessModules

uxtheme

CloseThemeData
DrawThemeBackground
OpenThemeData
IsThemeActive
GetThemeSysColor

kernel32

SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
HeapDestroy
HeapCreate
GetFileType
WriteConsoleA
CreateFileW
SetStdHandle
SetFilePointer
GetLocaleInfoA
GetLocaleInfoW
WinExec
Sleep
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrcmpW
lstrlenW
CreateSemaphoreW
lstrcmpiW
GetTickCount
GetVersionExW
FreeLibrary
GetUserDefaultLangID
MultiByteToWideChar
CloseHandle
WaitForSingleObject
CreateEventW
GetProcAddress
GetModuleHandleW
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
DeleteCriticalSection
GetModuleHandleA
GetModuleFileNameA
GetProcessHeap
WriteFile
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapFree
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
GetStartupInfoA
GetCommandLineA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
RaiseException
LoadLibraryExW
SetLastError
GetSystemDirectoryW
LocalAlloc
ReleaseMutex
lstrcatW
GetFileAttributesW
GetCurrentProcess
IsWow64Process
ExpandEnvironmentStringsW
LoadLibraryW
GetLastError
GetCurrentThreadId
CreateMutexW
OutputDebugStringW
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
FormatMessageW
VirtualFree
LocalFree
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetCPInfo
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
ReadFile
GetStdHandle
CreateFileA
VirtualAlloc

user32

EnumWindows
FillRect
GetWindowPlacement
IntersectRect
GetMonitorInfoW
LoadStringW
CopyIcon
IsRectEmpty
IsHungAppWindow
GetClassNameW
GetClassLongW
IsIconic
GetWindow
PostQuitMessage
UnregisterClassW
EnumDisplayDevicesW
EnumDisplaySettingsW
EqualRect
DeregisterShellHookWindow
RegisterWindowMessageW
RegisterShellHookWindow
DispatchMessageW
GetMessageW
TranslateMessage
PostMessageW
IsWindowVisible
UpdateWindow
InvalidateRect
GetSysColor
ScreenToClient
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
RedrawWindow
GetParent
GetWindowThreadProcessId
FindWindowExW
SetForegroundWindow
GetForegroundWindow
ClientToScreen
PtInRect
GetWindowTextW
DestroyIcon
KillTimer
GetClassInfoExW
LoadIconW
LoadCursorW
GetSysColorBrush
LoadImageW
RegisterClassExW
RegisterClassW
DefWindowProcW
GetWindowLongW
CreateWindowExW
GetCursorPos
LoadMenuW
TrackPopupMenu
DestroyMenu
SetWindowLongW
DestroyWindow
GetSubMenu
CheckMenuItem
CascadeWindows
TileWindows
FindWindowW
ShowWindow
SendMessageW
GetWindowRect
SetTimer
SetWindowPos
MoveWindow
GetClientRect
CreatePopupMenu
MonitorFromPoint
InflateRect

gdi32

DeleteObject
CreateSolidBrush

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
DeregisterEventSource
ReportEventW
GetSecurityDescriptorSacl
SetSecurityInfo
RegisterEventSourceW
RegCloseKey

shell32

ShellExecuteW
SHAppBarMessage

ole32

CoCreateInstance
CoUninitialize
CoInitialize

nview

ord292
ord207
ord206
ord251
ord805
ord232
ord204

Sections

.text
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

223b579b60443779c59132313f69aa3b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2eSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

dwmapi

gdiplus

psapi

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

nview

Sections

.text Size: 274KB - Virtual size: 273KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 11KB - Virtual size: 10KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

24:ac:39:2d:01:6b:11:b3:78:e4:08:39:05:19:c4:e3:2f:11:b1:2e
Signer

.text
Size: 274KB - Virtual size: 273KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 11KB - Virtual size: 10KB