2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe
Size 1.8MB
Sample240913-bgt4pswalk
SHA256 2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061
MD5 6dc0d350d735fd1acc8219cfa5d02b9b
SHA1 7ba0708a4404715fb21a23acfbd88a25b7245ef1
SHA512 99c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f
SSDEEP 24576:jn6mclQ1O/p0g/9fTeVB1SATDqj2/lDRa+QR6P3r3dl60NWEEk6d:jnhclke0wfoHSASyNNFI6P3rNlHNp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe

File Explorer

2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe

.dll 1.8MB

2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe

IMPHASH e78141e724292ad3a360b1a7baf7cfab
SHA256 2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061
MD5 6dc0d350d735fd1acc8219cfa5d02b9b
SHA1 7ba0708a4404715fb21a23acfbd88a25b7245ef1
SHA512 99c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f
SSDEEP 24576:jn6mclQ1O/p0g/9fTeVB1SATDqj2/lDRa+QR6P3r3dl60NWEEk6d:jnhclke0wfoHSASyNNFI6P3rNlHNp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

656672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\r560\r560_78\drivers\ui\uxd\bin\x64\Release\NvXDSyncPlugin.pdb

rpcrt4

IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrOleAllocate NdrOleFree CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrCStdStubBuffer_Release

shlwapi

PathFindFileNameW

kernel32

EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetFileType GetStdHandle GetCurrentThread FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess VirtualAlloc RtlUnwindEx InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader AreFileApisANSI MoveFileExW VerSetConditionMask CreateFileW GetFileAttributesW GetFullPathNameW CloseHandle GetLastError SetLastError GetSystemDirectoryW FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LocalAlloc LocalFree VerifyVersionInfoW ExpandEnvironmentStringsW GetFileSizeEx WriteFile OutputDebugStringW EncodePointer DecodePointer RaiseException QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc HeapReAlloc HeapFree HeapSize FindFirstFileExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent ResetEvent ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexW CreateEventA CreateEventW OpenEventW Sleep WaitForMultipleObjects GetProcessTimes GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThreadId ProcessIdToSessionId GetSystemTimeAsFileTime LoadResource SizeofResource FindResourceW lstrcmpiW SetDllDirectoryW MultiByteToWideChar WideCharToMultiByte DuplicateHandle ReleaseSemaphore WaitForMultipleObjectsEx CreateSemaphoreA WTSGetActiveConsoleSessionId GetVersionExW TerminateProcess GetLocaleInfoW IsValidCodePage GetACP GetCommandLineA GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetStdHandle ReadConsoleW WriteConsoleW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes VirtualFree InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW GetProcessHeap DeviceIoControl SetFilePointerEx RemoveDirectoryW FindNextFileW FindClose DeleteFileW CreateDirectoryW FormatMessageA SystemTimeToFileTime CreateWaitableTimerA GetModuleHandleA GetLogicalProcessorInformation ResumeThread SetWaitableTimer OpenEventA GetCPInfo LCMapStringW CompareStringW GetTickCount TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetStringTypeW GetStartupInfoW IsDebuggerPresent GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead

advapi32

RegEnumValueW RegQueryValueExW TraceMessage GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

ole32

CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoRevokeClassObject CoTaskMemFree CoCreateInstanceEx CoRegisterClassObject CoTaskMemRealloc CoSuspendClassObjects CoInitializeEx

oleaut32

SysFreeString SysStringLen VarUI4FromStr LoadTypeLi SysAllocString UnRegisterTypeLi RegisterTypeLi

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

255B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

437KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=12, id=259, version=26715,

count=2, id=261, version=23013,

count=9, id=259, version=24123,

count=38, id=260, version=24123,

count=25, id=260, version=26715,

count=122, id=261, version=24123,

count=2, id=262, version=26715,

count=27, id=257, version=26715,

count=370, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=179, id=261, version=26715,

count=94, id=264, version=24215,

count=3, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=12, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,