1db686635bcdde30163e1e624c4d8f107fd2a20507690151c69cc6a0c482207a[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

1db686635bcdde30163e1e624c4d8f107fd2a20507690151c69cc6a0c482207a.exe
Size

701KB
MD5

8703a1209bd5be3e9c15eb4e5db332de
SHA1

0e110df37f6315f3a76b12714afcc55323563388
SHA256

1db686635bcdde30163e1e624c4d8f107fd2a20507690151c69cc6a0c482207a
SHA512

2dbd2753264091580055bbbcde0c6de15c3eaa593f1c1eabf0d65cc886298149798dde80259058090b2bbb446dfab27589d90fe3f92411721d90c81c9234b9c4
SSDEEP

12288:MxoevQe9z3gFRpto9dqdUbkXlBWMbM9q2xsEX9Tmo8w7jkPpzGL8SCU2o3Fa52xg:Mx1vQeaLzGL8SCdYnW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1db686635bcdde30163e1e624c4d8f107fd2a20507690151c69cc6a0c482207a.exe

Files

1db686635bcdde30163e1e624c4d8f107fd2a20507690151c69cc6a0c482207a.exe
.dll windows:6 windows x64 arch:x64

a344e435672884d67246eff7e8c2670e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r560\r560_78\drivers\nvcamera\redist\_out\wddm2_amd64_release\NvCameraAllowlisting64.pdb

Imports

kernel32

GetSystemDirectoryW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
VerifyVersionInfoW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetCommandLineW
GetEnvironmentVariableW
SetLastError
GetFileInformationByHandle
GetFileSizeEx
ReadFile
RemoveDirectoryW
SetFileInformationByHandle
WriteFile
GetCurrentProcess
GetSystemTimeAsFileTime
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
GetModuleHandleExW
LoadLibraryA
CreateDirectoryW
GetCurrentProcessId
LoadLibraryW
OpenMutexA
CreateEventW
WriteConsoleW
GetLastError
CloseHandle
GetFullPathNameW
GetFileAttributesW
CreateFileW
VerSetConditionMask
SetEndOfFile
HeapSize
ReadConsoleW
SetStdHandle
SetFilePointerEx
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetFolderPathW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

AnselEnableCheck
AnselGetVersion
AnselShimDisableCheck

Sections

.text
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

V+N
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a344e435672884d67246eff7e8c2670e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

version

Exports

Exports

Sections

.text Size: 481KB - Virtual size: 481KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 8KB - Virtual size: 33KB

.pdata Size: 19KB - Virtual size: 19KB

_RDATA Size: 512B - Virtual size: 384B

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 3KB - Virtual size: 3KB

V+N Size: 70KB - Virtual size: 72KB

.text
Size: 481KB - Virtual size: 481KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 8KB - Virtual size: 33KB

.pdata
Size: 19KB - Virtual size: 19KB

_RDATA
Size: 512B - Virtual size: 384B

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 3KB - Virtual size: 3KB

V+N
Size: 70KB - Virtual size: 72KB