C:\dvs\p4\build\sw\rel\gfclient\rel_03_27\shadowplay2\NgxDlisr\win7_amd64_release\nvdlisrwrapper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
15868c69379e351424df05a79fab532d68e5d8283e20d63bd4d74baacaf9ba55.exe
Resource
win7-20240221-en
General
-
Target
15868c69379e351424df05a79fab532d68e5d8283e20d63bd4d74baacaf9ba55
-
Size
1.6MB
-
MD5
5d68013bcc3f26818f12775b5f9a2ea3
-
SHA1
8312f6f5bfa353721316bcdc650b8023d242fec6
-
SHA256
15868c69379e351424df05a79fab532d68e5d8283e20d63bd4d74baacaf9ba55
-
SHA512
fc0e01a8c4362c1396d401f0be4bdb22ba746ab9f38243f1b80d9afcb5661acb6aab4021ad6838147df65bba4c549024a8a2bd607c191261e1f596dfc4e04397
-
SSDEEP
24576:omLYHb/L4ia3NaadXct46Czpzw8sEjB3zYQrOeG:oOY/4i4NFtl6Czpzw8K3e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 15868c69379e351424df05a79fab532d68e5d8283e20d63bd4d74baacaf9ba55
Files
-
15868c69379e351424df05a79fab532d68e5d8283e20d63bd4d74baacaf9ba55.exe windows:6 windows x64 arch:x64
1b2a977439624bcd4824dbaa227b6513
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shell32
SHGetFolderPathA
SHGetFolderPathW
gdiplus
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
user32
UnregisterClassA
EnumDisplaySettingsA
FindWindowA
SendMessageA
advapi32
FreeSid
CreateRestrictedToken
AllocateAndInitializeSid
RegDeleteKeyValueA
RegSetValueExA
RegQueryValueExW
RegDeleteKeyExA
RegCreateKeyExA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameW
GetUserNameA
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateSelf
GetSecurityDescriptorDacl
SetThreadToken
OpenThreadToken
CreateWellKnownSid
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
gdi32
DeleteDC
kernel32
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
WriteConsoleW
LocalFree
DecodePointer
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ResetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
CreateThread
GetCurrentThreadId
ExitThread
FreeLibrary
GetProcAddress
CreateDirectoryA
CreateFileA
DeleteFileA
GetFileAttributesA
GetFileSizeEx
GetFinalPathNameByHandleA
WriteFile
OutputDebugStringA
InitializeCriticalSection
GetCurrentProcessId
GetCurrentThread
GetLocalTime
GetModuleFileNameW
GetModuleHandleW
LocalAlloc
RtlUnwind
CopyFileA
MoveFileExA
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
OpenProcess
LoadLibraryA
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
SetLastError
CreateProcessA
CreateProcessW
GetSystemDirectoryW
GetModuleFileNameA
LoadLibraryExW
lstrcmpA
VerifyVersionInfoW
FileTimeToSystemTime
Sleep
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
IsDebuggerPresent
GetCommandLineA
SetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
ExitProcess
GetModuleHandleExW
GetStdHandle
MultiByteToWideChar
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 259KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 437B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ