NvBackendAPI[.]dll[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NvBackendAPI.dll.exe
Size

1.4MB
MD5

2c8f5e9be81c328e5923a49cfe4f46f0
SHA1

3724874d77ef119e0f78361d696c40e0f7bbab87
SHA256

6a88ed7ea6abee1bb9dbb1b03bb5a0d450881a3b1fc4436028bacf7f0f96162a
SHA512

6a3d630914a7935a03d436de24594e35caa341954b2cfef3abd14628b67cb84ac1814e33504e0f54e5d2e62f717886d8b36ebd72cb396e750bb40fade8e1e88d
SSDEEP

24576:ic2wjGl9YhPr99TvXS7nEX7HO8/G71L0BowS8:ic2wKlehrrTvi7nEqJ71LwS8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NvBackendAPI.dll.exe

Files

NvBackendAPI.dll.exe
.dll windows:6 windows x64 arch:x64

44c9d5afca8eaf3318f50abb228d6456

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gfclient\rel_03_28\backend\build\bin\x64\Release\NvBackendAPI64.pdb

Imports

kernel32

SetEvent
ResetEvent
CreateEventW
lstrlenA
CreateFileW
ReadFile
SetFilePointerEx
WriteFile
FindClose
FindNextFileW
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetNativeSystemInfo
LocalFree
FormatMessageW
SystemTimeToFileTime
CreateFileA
FlushFileBuffers
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
CancelIo
WaitForMultipleObjects
GetCurrentProcess
CreateNamedPipeA
WaitNamedPipeA
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
FindFirstFileExW
SetLastError
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
MultiByteToWideChar
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
ExitThread
ResumeThread
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
GetStdHandle
GetFileType
HeapReAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
CloseHandle
OpenEventW
WaitForSingleObject
OpenFileMappingW
UnmapViewOfFile
ProcessIdToSessionId
MapViewOfFile
VirtualQuery
WideCharToMultiByte
FileTimeToSystemTime
DeleteCriticalSection
GetLastError
Sleep
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLocaleInfoW
EnterCriticalSection

advapi32

SetEntriesInAclW
SetSecurityDescriptorDacl
GetTokenInformation
OpenProcessToken
OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
ConvertStringSidToSidW

ws2_32

getsockname
htons
listen
recv
select
send
setsockopt
shutdown
socket
WSAStartup
WSACleanup
connect
htonl
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
bind
accept
WSAGetLastError
gethostbyname
inet_addr
ioctlsocket
getsockopt
__WSAFDIsSet

Exports

Exports

AddFeedback
AddFeedback_5
Application_FreeFeatureStates
Application_FreeTranslation
Application_GetFeatureStates
Application_GetSettingsSpace_2
Application_GetSliderSettings
Application_GetState_4
Application_GetTranslation
Application_Launch
Application_OptimizeForSDK
Application_RegisterStateChangedCallback
Application_RevertOPS
Application_SetBattery
Application_SetSettings
Application_ShouldReportTelemetry
Application_UnregisterStateChangedCallback
ClaimLicense
EasyAPIDeinit
EasyAPIInit
EnsureThatBackendIsRunning
FRLGetState
FRLSetState
FreeApplication
FreeApplicationState_4
FreeApplications
FreeDriverUpdates
FreeFeatureSupportState
FreeKeyValueFieldArray
FreeQuietMode2FeatureSupportState
FreeSYSTEMTIME
FreeSettingsSpace_2
FreeSignGPUIDOutput
FreeSliderSettings
FreeSupportedApplications
GetApplicationByImagePath
GetApplications
GetBatteryBoost2State
GetBatteryBoost2SupportState
GetBatteryBoostFRLState
GetDaemonVersion
GetDeepDVCState
GetDriverUpdates
GetEnableAutomaticDriverDownload
GetGRDEditorPreviewMode
GetGlobalConfigurationSettings
GetHardwareInformation
GetHardwareInformation_2
GetLastApplicationScanTime
GetNIS2State
GetPerformanceModeState
GetPerformanceModeSupportState
GetQuietMode2State
GetQuietMode2SupportState
GetQuietModeFRLState
GetQuietModeState
GetQuietModeSupportState
GetSignedGPUID
GetSupportedApplications_2
GetUserDriverTypePreference
IsFRLSupported
LauncherPid_Get
NVBAPI_MigratePreGalaxSettings
NVBAPI_Streaming_FreeInterface_1
NVBAPI_Streaming_FreeInterface_10
NVBAPI_Streaming_FreeInterface_2
NVBAPI_Streaming_FreeInterface_3
NVBAPI_Streaming_FreeInterface_4
NVBAPI_Streaming_FreeInterface_5
NVBAPI_Streaming_FreeInterface_6
NVBAPI_Streaming_FreeInterface_7
NVBAPI_Streaming_FreeInterface_8
NVBAPI_Streaming_FreeInterface_9
NVBAPI_Streaming_GetInterface_1
NVBAPI_Streaming_GetInterface_2
NotifyExperimentalFeaturesChange
NotifyUiLanguageChange
NotifyUserIdChange
RefreshApplicationsState
RegisterApplicationListChangeCallbacks_2
RegisterApplicationScanProgressCallback_2
RegisterBatteryBoost2StateCallback
RegisterDriverUpdateCheckProgressCallbacks
RegisterNIS2StateCallback
RegisterNvBackendReadyCallback
RegisterPerformanceModeStateCallback
RegisterPerformanceModeSupportStateCallback
RegisterQuietMode2StateCallback
RegisterQuietMode2SupportStateCallback
RegisterQuietModeStateCallback
RegisterQuietModeSupportStateCallback
RegisterRewardsCheckProgressCallbacks
ScanAndCheckUpdates
ScanAndCheckUpdates_2
ScrubApplications
SearchPaths_Add
SearchPaths_Free
SearchPaths_Get_2
SearchPaths_Remove
SetBatteryBoost2State
SetBatteryBoostFRLState
SetDeepDVCState
SetEnableAutomaticDriverDownload
SetGFWSLUrl
SetGlobalConfigurationSettings
SetJarvisUrl
SetNIS2State
SetOOTBStatus
SetPerformanceModeState
SetQuietMode2State
SetQuietModeFRLState
SetQuietModeState
SetUserDriverTypePreference
StartDriverUpdatesCheck
UnRegisterBatteryBoost2StateCallback
UnregisterApplicationListChangeCallbacks
UnregisterApplicationScanProgressCallback
UnregisterDriverUpdateCheckProgressCallbacks
UnregisterNIS2StateCallback
UnregisterNvBackendReadyCallback
UnregisterPerformanceModeStateCallback
UnregisterPerformanceModeSupportStateCallback
UnregisterQuietMode2StateCallback
UnregisterQuietMode2SupportStateCallback
UnregisterQuietModeStateCallback
UnregisterQuietModeSupportStateCallback
UnregisterRewardsCheckProgressCallbacks
VOPS_FreePath
VOPS_GetPath_2
VOPS_GetStatus
VOPS_RegisterCallback
VOPS_UnregisterCallback

Sections

.text
Size: 832KB - Virtual size: 831KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44c9d5afca8eaf3318f50abb228d6456

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 832KB - Virtual size: 831KB

.rdata Size: 274KB - Virtual size: 273KB

.data Size: 14KB - Virtual size: 28KB

.pdata Size: 38KB - Virtual size: 37KB

_RDATA Size: 512B - Virtual size: 256B

.rsrc Size: 247KB - Virtual size: 247KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 832KB - Virtual size: 831KB

.rdata
Size: 274KB - Virtual size: 273KB

.data
Size: 14KB - Virtual size: 28KB

.pdata
Size: 38KB - Virtual size: 37KB

_RDATA
Size: 512B - Virtual size: 256B

.rsrc
Size: 247KB - Virtual size: 247KB

.reloc
Size: 6KB - Virtual size: 6KB