GPUSniffer[.]exe

Resubmissions

26/05/2024, 15:50

240526-s94maabf7w 6

Sharing

Copy URL Twitter E-mail

General

Target

GPUSniffer.exe
Size

73KB
MD5

838a551ac5b465de71ef76a0f6447751
SHA1

19ceb9e2b3030d5c41d727a1bc915a5532f7569c
SHA256

9197bc809aa6be61ff67f23c11c648d7a83311c789199f9cdef0b7157d22c795
SHA512

395a52f43aabd550fae5b0b82d28a6b9a248faff078d4094004cf664e037fc43a894bb16594ae7e405c01072c87a421aa1696394b018df19d961a70333417cfb
SSDEEP

1536:ZF6wM4rdxAITsjb/7kv69J97HE2Vkh9ypPLRVu6VwC9:ZF6wfhCIYjkS9rky49ypPLRVuY

Score

1^/10

Malware Config

Signatures

Files

GPUSniffer.exe
.exe windows:6 windows x64 arch:x64

e442aa99fc304896b3df430303bfa9c1

Code Sign

05:96:37:35:c0:e0:1c:f3:7d:3e:39:31:40:eb:af:4b
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/12/2020, 00:00

Not After

21/12/2022, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:0a:88:2b:86:9f:3c:d2:21:61:3a:9c:ab:c8:ab:12:e2:43:22:be:83:fc:70:ae:63:6c:e6:51:e0:22:06:a0
Signer

Actual PE Digest

a5:0a:88:2b:86:9f:3c:d2:21:61:3a:9c:ab:c8:ab:12:e2:43:22:be:83:fc:70:ae:63:6c:e6:51:e0:22:06:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\releases\dva\shared\adobe\MediaCore\DisplaySurface\GPUSniffer\Targets\Win\Release\64\GPUSniffer.pdb

Imports

prm

?Initialize@PRM@@YAXW4ApplicationType@1@PEBD11_N@Z

displaysurface

?GPUSnifferBenchmark@DS@@YAIAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEAUGPUSnifferRunData@1@@Z
?GPUSnifferMain@DS@@YAIAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@I@Z

dvaappsupport

?RegisterUserID@feature@dvaappsupport@@YAXAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@@Z

dvacore

?SetEntry@DebugDatabase@debug@dvacore@@QEAAXAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@0@Z
?SetFileWritesDisabled@DebugDatabase@debug@dvacore@@QEAAX_N@Z
?RegisterCurrentThreadAsMainThread@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@XZ
??0MemoryMappedFile@dvacore@@QEAA@XZ
??1MemoryMappedFile@dvacore@@QEAA@XZ
?Open@MemoryMappedFile@dvacore@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KI@Z
?GetAddress@MemoryMappedFile@dvacore@@QEAAPEAXXZ
?GetAppPrefsVersionString@versioninfo@dvacore@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?LimitedDLLHijackFix@config@dvacore@@YAXXZ
?Instance@DebugDatabase@debug@dvacore@@SAAEAV123@XZ
?kAppMajorVersion@config@dvacore@@3PEBDEB
?kAppMinorVersion@config@dvacore@@3PEBDEB
?kAppPatchVersion@config@dvacore@@3PEBDEB
?kAppBuildNumber@config@dvacore@@3PEBDEB
?kSuiteVersion@config@dvacore@@3PEBDEB
?kSuiteBrandingVersion@config@dvacore@@3PEBDEB
?kSuiteBrandingMinorVersion@config@dvacore@@3PEBDEB
?kAppIsHeadless@config@dvacore@@3PEBDEB
?kProcessExitStatus@config@dvacore@@3PEBDEB
?kAppShortName@config@dvacore@@3PEBDEB
?Terminate@ConsoleLogFile@console@dvacore@@SAXXZ
?Allocate@MemoryRecycler@allocator@dvacore@@YAPEAX_KAEA_K@Z
?NotifyProcessEnd@ProcessBeginEndNotificationRegistry@config@dvacore@@QEAAXAEBV?$array@VParameter@detail@config@dvacore@@$09@std@@@Z
?NotifyProcessBegin@ProcessBeginEndNotificationRegistry@config@dvacore@@QEAAXAEBV?$array@VParameter@detail@config@dvacore@@$09@std@@@Z
?GetInstance@ProcessBeginEndNotificationRegistry@config@dvacore@@SAAEAV123@XZ
?EarlyInitialize@config@dvacore@@YA_NXZ
?Set@ErrorManager@config@dvacore@@SAXPEAV123@@Z
??1ErrorManager@config@dvacore@@UEAA@XZ
??0ErrorManager@config@dvacore@@QEAA@XZ
??1DummyLocalizerImpl@config@dvacore@@UEAA@XZ
??0DummyLocalizerImpl@config@dvacore@@QEAA@XZ
?SetAppIsHeadless@config@dvacore@@YAX_N@Z
?SetCompanyName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientInternalVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetApplicationName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?Set@Localizer@config@dvacore@@SAXPEAV123@AEBVDir@filesupport@3@@Z
??1Dir@filesupport@dvacore@@QEAA@XZ
??0Dir@filesupport@dvacore@@QEAA@XZ
?AsciiToUTF16@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBD_K@Z
?StdToUTF16String@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBD@Z
?SetDisableFileWrites@debug@dvacore@@YAX_N@Z
?Recycle@MemoryRecycler@allocator@dvacore@@YAXPEAX_K@Z

boost_program_options

??0validation_error@program_options@boost@@QEAA@AEBV012@@Z
??0invalid_option_value@program_options@boost@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1invalid_option_value@program_options@boost@@UEAA@XZ
?set_additional_parser@cmdline@detail@program_options@boost@@QEAAXV?$function1@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@4@@Z
??1cmdline@detail@program_options@boost@@QEAA@XZ
??0invalid_option_value@program_options@boost@@QEAA@AEBV012@@Z
?m_default_line_length@options_description@program_options@boost@@2IB
?arg@program_options@boost@@3V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?what@error_with_option_name@program_options@boost@@UEBAPEBDXZ
?substitute_placeholders@error_with_option_name@program_options@boost@@MEBAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0?$value_semantic_codecvt_helper@D@program_options@boost@@QEAA@XZ
?set_option_name@error_with_option_name@program_options@boost@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?parse@?$value_semantic_codecvt_helper@D@program_options@boost@@EEBAXAEAVany@3@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@_N@Z
??0error_with_option_name@program_options@boost@@QEAA@AEBV012@@Z
??0error@program_options@boost@@QEAA@AEBV012@@Z
??0validation_error@program_options@boost@@QEAA@W4kind_t@012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1H@Z
??0variables_map@program_options@boost@@QEAA@XZ
?count@?$_Tree@V?$_Tmap_traits@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vvariable_value@program_options@boost@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vvariable_value@program_options@boost@@@std@@@2@$0A@@std@@@std@@QEBA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?notify@program_options@boost@@YAXAEAVvariables_map@12@@Z
??1?$value_semantic_codecvt_helper@D@program_options@boost@@UEAA@XZ
?check_first_occurrence@validators@program_options@boost@@YAXAEBVany@3@@Z
?validate@program_options@boost@@YAXAEAVany@2@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@H@Z
??0cmdline@detail@program_options@boost@@QEAA@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?run@cmdline@detail@program_options@boost@@QEAA?AV?$vector@V?$basic_option@D@program_options@boost@@V?$allocator@V?$basic_option@D@program_options@boost@@@std@@@std@@XZ
?set_options_description@cmdline@detail@program_options@boost@@QEAAXAEBVoptions_description@34@@Z
??1validation_error@program_options@boost@@UEAA@XZ
?store@program_options@boost@@YAXAEBV?$basic_parsed_options@D@12@AEAVvariables_map@12@_N@Z
?get_canonical_option_prefix@cmdline@detail@program_options@boost@@QEAAHXZ
?style@cmdline@detail@program_options@boost@@QEAAXH@Z
??Roptions_description_easy_init@program_options@boost@@QEAAAEAV012@PEBD0@Z
??Roptions_description_easy_init@program_options@boost@@QEAAAEAV012@PEBDPEBVvalue_semantic@12@0@Z
??0options_description@program_options@boost@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@II@Z
?add_options@options_description@program_options@boost@@QEAA?AVoptions_description_easy_init@23@XZ
??6program_options@boost@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV23@AEBVoptions_description@01@@Z
??1options_description@program_options@boost@@QEAA@XZ
??1variables_map@program_options@boost@@UEAA@XZ
?to_internal@program_options@boost@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z

kernel32

GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
GetLastError
SetErrorMode
InitializeCriticalSectionEx
DeleteCriticalSection

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?classic@locale@std@@SAAEBV12@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
??Bid@locale@std@@QEAA_KXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Query_perf_counter
_Query_perf_frequency
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

vcruntime140

memmove
memcpy
memcmp
__C_specific_handler
__std_type_info_compare
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
__current_exception
__current_exception_context
memset
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

terminate
_register_onexit_function
_cexit
_seh_filter_exe
_configure_narrow_argv
_set_app_type
_crt_atexit
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_get_initial_narrow_environment
_exit
exit
_initterm_e
_initterm
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
_callnewh
malloc
calloc

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

e442aa99fc304896b3df430303bfa9c1

Code Sign

05:96:37:35:c0:e0:1c:f3:7d:3e:39:31:40:eb:af:4bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

a5:0a:88:2b:86:9f:3c:d2:21:61:3a:9c:ab:c8:ab:12:e2:43:22:be:83:fc:70:ae:63:6c:e6:51:e0:22:06:a0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

prm

displaysurface

dvaappsupport

dvacore

boost_program_options

kernel32

ole32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 9KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

05:96:37:35:c0:e0:1c:f3:7d:3e:39:31:40:eb:af:4b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a5:0a:88:2b:86:9f:3c:d2:21:61:3a:9c:ab:c8:ab:12:e2:43:22:be:83:fc:70:ae:63:6c:e6:51:e0:22:06:a0
Signer

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 9KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB