C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\telemetry\NvContainerTelemetryApi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Run-Malware-1.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Run-Malware-1.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Run-Malware-1.bat
Resource
win11-20240802-en
General
-
Target
Malware-1.zip
-
Size
4.1MB
-
MD5
fe28657d8940be729e24518e36439ea7
-
SHA1
33dd018243c6093ca79a63f18a360a87f38c17de
-
SHA256
928b6fbfa45c4744be590f2d8ccd193a203d2102aa37f8fce47ed38ba82f5829
-
SHA512
653880c4e0ba92f8eca6d25f3327b151668ec7dd7363f35cb20f476a9e9b5cc23d54b986a365ef2f9abcb294ed6a89bc7fc7c0f17c0d03df9d71be57aa7ae4ab
-
SSDEEP
98304:SRlq/v3f08/+aG3eEExJ5a9HqCN9l6rQ5cva09wcrJZ6yUPxsIYJyjcjW48KdhLg:Sm/nT+aGuzat9l6WmwgZ6BBRjd48gBy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NvContainerTelemetryApi.dll
Files
-
Malware-1.zip.zip
-
NvContainerTelemetryApi.dll.dll windows:6 windows x64 arch:x64
071fa25c9950b34e0961bf2a584ecc88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetCurrentProcessId
WriteConsoleW
OutputDebugStringW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
WriteFile
GetLastError
FreeLibrary
GetProcAddress
GetSystemDirectoryW
GetNativeSystemInfo
GetModuleFileNameW
WideCharToMultiByte
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
CloseHandle
SetLastError
CreateProcessA
CreateProcessW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
LocalAlloc
LocalFree
VerifyVersionInfoW
FlushFileBuffers
HeapSize
SetStdHandle
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
RtlUnwind
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetCurrentThread
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetFileSizeEx
SetFilePointerEx
shell32
SHGetFolderPathW
Exports
Exports
cest
qest
qest
Qest
Test
Send_NvcPluginLoadStats_Event
Send_NvcPluginResumeStats_Event
Send_NvcPluginUnloadStats_Event
Send_NvcUnloadStats_Event
Send_NvpWatchdogChildContainerProcessStats_Event
Sections
.text Size: 731KB - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Run-Malware-1.bat