c56cac95726fd10b5a85be1c87336354.bin
- SHA256 e49e2826c4d9fae960ca6baecd6754400e5da74446c5b511beb15831b42f2b1d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nv.exe
Resource
win7-20231129-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nv.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
NvSmartMax.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
NvSmartMax.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target c56cac95726fd10b5a85be1c87336354.bin
- Size 146KB
- Sample240209-egbtxafe51
- SHA256 e49e2826c4d9fae960ca6baecd6754400e5da74446c5b511beb15831b42f2b1d
- MD5 c56cac95726fd10b5a85be1c87336354
- SHA1 b29b5a35c3ecd559047e8477e949ac72e9bdc52d
- SHA512 d6dd8283320330199e9235e4e8bb2ed7995f5c6cb51a08e2118502660bc8ce29d7490198e1dcba9641b199b8d7f80c1708948230b69392cfd8391c5a7d505ab5
- SSDEEP 3072:MljIdulYQyNl7bAT+JbjClf00YM8SzR1hv0iuzFWC9FnbfztQf:Mj+uqXAT6jClkao5WCrbCf
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NvSmartMax.dll
File Explorer
-
c56cac95726fd10b5a85be1c87336354.bin.rar 146KB
-
Nv.exe.exe 46KB
-
Nv.mp3120KB
-
NvSmartMax.dll.dll 20KB
Nv.exe
- IMPHASH df7251fdce5e0d0813311ec9d52fde93
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
44:3e:34:71:b3:ff:c7:aa:dc:22:b9:67:5a:6d:45:35:d2:55:89:99
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
May 21, 2011
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 31, 2009 - Sep 1, 2011
Minor OS version
0
Major OS version
5
Entry point
6097
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
GetMessageW
DispatchMessageW
TranslateMessage
LoadCursorW
RegisterClassExW
EnumDisplayDevicesW
EnumWindows
PostQuitMessage
DefWindowProcW
GetWindowRect
IsRectEmpty
GetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
GetClassNameW
CreateWindowExW
ShowWindow
UpdateWindow
nvsmartmax
NvSmartMaxNotifyAppHWND
NvSmartMaxUseDynamicDeviceGrids
GetContainingRect
kernel32
TlsGetValue
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
RtlUnwind
HeapReAlloc
VirtualAlloc
HeapAlloc
IsValidCodePage
GetOEMCP
lstrcmpW
OutputDebugStringW
CloseHandle
GetLastError
CreateMutexW
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, id=132, productName=VS2008 build 21022, version=21022,
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=99, id=1, productName=Unmarked objects,
count=74, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Nv.mp3
- SHA256 3d64e638f961b922398e2efaf75504da007e41ea979f213f8eb4f83e00efeebb
- MD5 5ef7c3bcbc11cd02c95e509b226eebe9
- SHA1 794a90212d226628c8ce4441c3418c1ecca0e3b8
- SHA512 c86f464f736125d8fb499efe2555cae1aea5d67fbf15be816883e058ad9107eb399d3ade6c5afe811a2eb59ebdc1d52c992124359fa26085a650eb940fe2eae4
- SSDEEP 3072:5QyNl7bAT+JbjClf00YM8SzR1hv0iuzFWC9FnbfztQ:XXAT6jClkao5WCrbC
- MD5 SHA1 SHA512 SSDEEP
NvSmartMax.dll
- IMPHASH 55f545b852f16a3aca666a8521f8e760
- SHA256 eaaa7899b37a3b04dcd02ad6d51e83e035be535f129773621ef0f399a2a98ee3
- MD5 0b21678ed8e2b117344cfceba8f097dd
- SHA1 db53bb022cb6de016713f1570f2ae501f20f9c76
- SHA512 182268649b360f44f021570ddc9290f5051a8be556ffd66355bc325027ba48c5fe824e1bea925411bdaef4c17e0f3d81a1d3c710b59c4462540d567da625a41a
- SSDEEP 24:eFGSE+O1B+ibXvS1vFNFPitSa25Jyj3xrqhx4/:ief+BFCtSa25JySx4/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLocalTime
GetModuleFileNameW
lstrcpyW
VirtualAlloc
CreateFileW
ReadFile
CloseHandle
VirtualProtect
Sleep
DisableThreadLibraryCalls
GetSystemTime
GetModuleHandleA
GetCon
GetContaining
GetContainingRect
NvSmart
NvSmartMax
NvSmartMaxNotifyAppHWND
NvSmartMaxUse
NvSmartMaxUseDynamicDeviceGrids
Name
.text
Size
4KB
Virtual Size
479B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
647B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
122B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,