GeforceNOW[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GeforceNOW.exe
Size

1014KB
MD5

22d57a95c122727b7e060aa1a4cc469e
SHA1

0639cb25303b903d7f0c4eda763827428513ef22
SHA256

30cd879a2e71b8aa3f31b2b32a855fee9006e65885d232b0102cf4906be9e971
SHA512

c2ef8be8074a7f99aa76ee9365bf98ad202626feee424ecf02a0e5a37993de3173dd4db424a4bf0cbb64ece69d30546b0a238bb9dfe6fb2983d42e87dd88e432
SSDEEP

24576:wX7yFD82Po9bLZayd2fVSf4xQXunIL79P1sUETR:wXOBQlZDd2djQ+nIL7QUETR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GeforceNOW.exe

Files

GeforceNOW.exe
.exe windows:6 windows x64 arch:x64

17e08dd8c5224ad54217121199045cf6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\M1ndyy\Desktop\Vanta Updated By SynthCheats\vanta\Vanta Remake Updated By Synth\Vanta Remake Updated By Synth\vanta\Selfed\x64\Release\GeforceNOW.pdb

Imports

d3d9

Direct3DCreate9Ex

kernel32

InitializeCriticalSectionEx
DeleteCriticalSection
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
QueryFullProcessImageNameW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
GetTickCount
OutputDebugStringW
GetFileInformationByHandleEx
AreFileApisANSI
lstrcmpiA
GetConsoleWindow
Beep
CreateThread
CloseHandle
Process32Next
GetLastError
Sleep
CreateToolhelp32Snapshot
CreateFileW
GetFileAttributesExW
SetConsoleWindowInfo
TerminateProcess
VirtualAlloc
DeviceIoControl
GetStdHandle
SetConsoleScreenBufferSize
GetCurrentProcess
SetConsoleTitleA
VirtualFree
GetConsoleScreenBufferInfo
VirtualProtect
Process32First
ReadFile
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
GlobalFree
GlobalAlloc
MultiByteToWideChar
UnhandledExceptionFilter
InitializeSListHead
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
SleepConditionVariableSRW
GetLocaleInfoEx

user32

DispatchMessageA
GetWindowRect
DestroyWindow
GetSystemMetrics
ShowWindow
SetWindowLongA
MessageBoxA
TranslateMessage
PeekMessageA
GetDesktopWindow
SetForegroundWindow
SendInput
GetAsyncKeyState
GetKeyState
LoadCursorA
ScreenToClient
ClientToScreen
GetForegroundWindow
SetCursor
GetClientRect
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
EmptyClipboard
GetClipboardData
SetClipboardData
FindWindowA

advapi32

CryptDestroyHash
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
OpenProcessToken
AddAccessAllowedAce
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptHashData
CryptCreateHash
CryptGetHashParam
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid

shell32

Shell_NotifyIconA
ShellExecuteA

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext

msvcp140

?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Mtx_unlock
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?_Winerror_map@std@@YAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

xinput1_4

ord2

normaliz

IdnToAscii

wldap32

ord26
ord27
ord32
ord50
ord33
ord35
ord45
ord79
ord30
ord200
ord301
ord60
ord211
ord46
ord22
ord217
ord143
ord41

crypt32

CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertGetNameStringA
CertCreateCertificateChainEngine
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptQueryObject

ws2_32

socket
WSASetLastError
ntohs
htons
WSAIoctl
getsockname
getpeername
connect
bind
WSAGetLastError
WSAStartup
send
recv
WSACleanup
closesocket
setsockopt
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
getsockopt

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy
strstr
__std_terminate
__std_exception_copy
memchr
memcmp
__C_specific_handler
memmove
memset
strchr
strrchr
__current_exception
__current_exception_context
memcpy
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

ftell
__acrt_iob_func
_set_fmode
feof
__stdio_common_vsprintf_s
_fseeki64
fflush
fputs
fopen
fclose
_open
_close
fputc
_lseeki64
_write
fseek
__stdio_common_vfprintf
_popen
_pclose
fgets
_read
_get_stream_buffer_pointers
__stdio_common_vsscanf
fsetpos
ungetc
fread
__stdio_common_vsprintf
setvbuf
fgetpos
_wfopen
__stdio_common_vsnprintf_s
__p__commode
fgetc
fwrite

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

isupper
strcspn
strncpy
strcmp
strpbrk
strspn
strncmp
tolower
_strdup

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh
realloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtod
atoi
atof
strtol
strtoul
strtoull
strtoll

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_get_initial_narrow_environment
_initterm
_initterm_e
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_getpid
system
terminate
_errno
strerror
__sys_nerr
_exit
abort

api-ms-win-crt-time-l1-1-0

_time64
strftime
_localtime64
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_lock_file
_unlock_file
_access
_unlink
_fstat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func
localeconv

api-ms-win-crt-math-l1-1-0

sqrtf
sinf
tanf
atan2
atan2f
powf
sqrt
fmodf
cosf
asin
acosf
_dclass
__setusermatherr
pow
ceilf

Sections

.text
Size: 793KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17e08dd8c5224ad54217121199045cf6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

kernel32

user32

advapi32

shell32

imm32

msvcp140

ntdll

xinput1_4

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

psapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 793KB - Virtual size: 792KB

.rdata Size: 159KB - Virtual size: 158KB

.data Size: 28KB - Virtual size: 35KB

.pdata Size: 30KB - Virtual size: 30KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 793KB - Virtual size: 792KB

.rdata
Size: 159KB - Virtual size: 158KB

.data
Size: 28KB - Virtual size: 35KB

.pdata
Size: 30KB - Virtual size: 30KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 2KB - Virtual size: 1KB