36d606ca82d760bc3dd1ad2e2fcd94b254dde29efae93e2ce2b065c3932cd6c0

Sharing

Copy URL Twitter E-mail

General

Target
36d606ca82d760bc3dd1ad2e2fcd94b254dde29efae93e2ce2b065c3932cd6c0
Size 6.5MB
Sample240603-ptm3taef7v
SHA256 36d606ca82d760bc3dd1ad2e2fcd94b254dde29efae93e2ce2b065c3932cd6c0
MD5 a90275e186b0017b8989706be0cdbbd2
SHA1 f4336edc21496430dc5956aacb2d308c891d7a65
SHA512 94d4c78d809379e98352b18ce6febc52e37ac8a01dc1f6e4ca5f5de3da2e3d8f573689237f982d3ef0b36d39c75eab548dfd58b31b2f81484206d3b29bf5fde2
SSDEEP 196608:qegBLyN4RGnJcXlF6SWvlhDlqoQitKtaDOsMw:tV4RGnJcXlF6SWLAo4/w
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

36d606ca82d760bc3dd1ad2e2fcd94b254dde29efae93e2ce2b065c3932cd6c0

.dll 6.5MB

36d606ca82d760bc3dd1ad2e2fcd94b254dde29efae93e2ce2b065c3932cd6c0

IMPHASH 8b5bebca47e321802c556fddf96896ba
SHA256 36d606ca82d760bc3dd1ad2e2fcd94b254dde29efae93e2ce2b065c3932cd6c0
MD5 a90275e186b0017b8989706be0cdbbd2
SHA1 f4336edc21496430dc5956aacb2d308c891d7a65
SHA512 94d4c78d809379e98352b18ce6febc52e37ac8a01dc1f6e4ca5f5de3da2e3d8f573689237f982d3ef0b36d39c75eab548dfd58b31b2f81484206d3b29bf5fde2
SSDEEP 196608:qegBLyN4RGnJcXlF6SWvlhDlqoQitKtaDOsMw:tV4RGnJcXlF6SWLAo4/w
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

7c:c2:c3:db:bd:49:7c:46:1c:b1:69:6a:b4:4c:dd:57:59:1a:6b:88:29:70:e8:26:a6:5e:41:b1:6b:b8:dc:18

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

Chains

Dec 15, 2022

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

Serial Number

08:00:ee:4e:d1:a9:59:cc:98:87:e9:05:ad:66:2b:fe

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 26, 2022 - Mar 1, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

Major OS version

Entry point

3350160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\u\workspace\InstallerCore_vs2017_3S\sw\rel\gpu_drv\installer_core\installer_core_vs2017\Build\Core\Out\Win32\Release\NVI2.pdb

kernel32

lstrlenW TlsSetValue TlsAlloc RaiseException TlsGetValue FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar LoadLibraryExW GetThreadLocale SetThreadLocale WaitForMultipleObjectsEx GetExitCodeThread DuplicateHandle LocalFree WaitForMultipleObjects GetVersionExW OpenMutexW GetSystemTime ResetEvent GetCommandLineW ResumeThread IsDebuggerPresent DebugBreak GetTickCount64 GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA OpenEventA DeleteFileW RemoveDirectoryW MoveFileExW GetCurrentThread SetThreadPriority OpenProcess Sleep OpenEventW GetDiskFreeSpaceW SetLastError CreateEventW GetTickCount DeleteCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource DecodePointer LockResource SizeofResource VerSetConditionMask VerifyVersionInfoW GetTempPathW GetCurrentProcessId WaitForSingleObject ReleaseMutex GetFileSizeEx WideCharToMultiByte WriteFile ExpandEnvironmentStringsW GetModuleFileNameW CreateFileW CloseHandle CreateMutexW GetLastError GetCurrentThreadId WaitForSingleObjectEx SetEvent CreateEventA OutputDebugStringW GetCurrentProcess GetProcessTimes GetSystemTimeAsFileTime QueryPerformanceFrequency EncodePointer QueryPerformanceCounter WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetACP EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetModuleFileNameA ExitProcess ExitThread RtlUnwind CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority CreateThread SwitchToThread SignalObjectAndWait GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetUserDefaultLCID GetStringTypeExW LoadLibraryA AreFileApisANSI FormatMessageA GetCPInfo LCMapStringW CompareStringW TlsFree TryEnterCriticalSection GetStringTypeW CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection VirtualFree VirtualAlloc GetFileInformationByHandle GetStdHandle SetFilePointer GetFileSize GetOverlappedResult lstrcmpA GetModuleHandleA GetFullPathNameW CompareFileTime SetFilePointerEx SetEndOfFile ReadFile FlushFileBuffers GetSystemDefaultLangID GetUserDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetDriveTypeW GetFileAttributesW GetFileAttributesExW GetFileTime GetTempFileNameW SetFileAttributesW SetFileTime DeviceIoControl GetSystemDirectoryW GetWindowsDirectoryW GetSystemWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GlobalAlloc GlobalFree lstrcmpW CopyFileW CopyFileExW LocalAlloc FileTimeToSystemTime TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleHandleExW LoadLibraryW CreateActCtxW ReleaseActCtx ActivateActCtx DeactivateActCtx GetLocalTime FormatMessageW SystemTimeToFileTime

user32

CharUpperW LoadStringW GetSystemMetrics GetLastActivePopup SendMessageTimeoutW AllowSetForegroundWindow CharNextW

advapi32

OpenThreadToken DuplicateToken GetFileSecurityW MapGenericMask GetNamedSecurityInfoW RegOpenCurrentUser RegGetKeySecurity AllocateAndInitializeSid FreeSid ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService EnumDependentServicesW OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceConfig2W QueryServiceObjectSecurity QueryServiceStatusEx SetServiceObjectSecurity StartServiceW SetEntriesInAclW BuildTrusteeWithSidW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorControl SetSecurityDescriptorDacl InitializeSecurityDescriptor InitiateSystemShutdownW AdjustTokenPrivileges LookupPrivilegeValueW ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertSidToStringSidW IsValidSecurityDescriptor RegDeleteValueW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW OpenProcessToken GetTokenInformation RegEnumValueW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW ConvertStringSidToSidW LsaNtStatusToWinError AccessCheck

shell32

ShellExecuteExW SHGetFolderPathW

ole32

StringFromGUID2 CoRegisterClassObject CoInitializeSecurity CoInitializeEx CoRevokeClassObject CoTaskMemFree CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit SysAllocStringByteLen SysStringByteLen VariantCopy LoadRegTypeLi LoadTypeLi SafeArrayCopy SafeArrayDestroy SafeArrayGetVartype SafeArrayUnlock SafeArrayLock VarCmp SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound VarUI4FromStr UnRegisterTypeLi SafeArrayRedim RegisterTypeLi VariantCopyInd VariantClear SysAllocStringLen VariantChangeType SafeArrayGetDim SysStringLen

sfc

SfcIsFileProtected

wintrust

WinVerifyTrust

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty

shlwapi

PathCreateFromUrlW UrlIsW PathFindFileNameW PathIsURLW

rpcrt4

UuidCreate RpcBindingFree NdrClientCall2 UuidToStringW UuidFromStringW RpcStringFreeW RpcStringBindingComposeW RpcBindingFromStringBindingW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

setupapi

SetupCloseInfFile SetupFindFirstLineW SetupOpenInfFileW CM_Get_Device_IDW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetActualSectionToInstallExW SetupDiSetSelectedDevice CMP_WaitNoPendingInstallEvents CM_Get_DevNode_Status SetupOpenAppendInfFileW SetupFindNextLine SetupFindNextMatchLineW SetupGetFieldCount SetupGetStringFieldW SetupGetIntField SetupDiSetDeviceInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiSetClassRegistryPropertyW SetupUninstallOEMInfW SetupDiCreateDeviceInfoList SetupDiSetDeviceRegistryPropertyW SetupDiGetClassRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiOpenDeviceInfoW SetupDiGetDeviceInstanceIdW SetupDiDeleteDeviceInfo SetupDiEnumDeviceInfo SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiSetSelectedDriverW SetupDiGetDriverInfoDetailW SetupDiBuildClassInfoList

userenv

UnloadUserProfile

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

266KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

318KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

430KB

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=19, id=259, version=25203,

count=183, id=261, version=25203,

count=23, id=260, version=25203,

count=26, id=259, version=25810,

count=15, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=35, id=260, version=25810,

count=55, id=261, productName=VS2017 v15.9.4 build 27025, version=27025,

count=14, id=260, productName=VS2017 v15.9.4 build 27025, version=27025,

count=1, id=259, productName=VS2017 v15.9.4 build 27025, version=27025,

count=1, id=260, productName=VS2017 v15.5.6 build 25835, version=25835,

count=49, id=261, productName=VS2017 v15.5.6 build 25835, version=25835,

count=1, id=209, version=65501,

count=6, id=206, version=65501,

count=31, id=203, version=65501,

count=125, id=261, version=25810,

count=445, id=1, productName=Unmarked objects,

count=3, id=208, version=65501,

count=113, id=265, version=25835,

count=1, id=256, productName=VS2017 v15.5.6 build 25835, version=25835,

count=1, id=255, productName=VS2017 v15.5.6 build 25835, version=25835,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.5.6 build 25835, version=25835,