6dc0d350d735fd1acc8219cfa5d02b9b[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

6dc0d350d735fd1acc8219cfa5d02b9b.bin
Size

727KB
MD5

570d9bf5654d51af0284efaab08f4930
SHA1

3e30c85b8bdc30f5829f433fc93227a22fbaaccf
SHA256

a45d666b68868a621a8d08c98245c69696287a81c24c7d9f61753944a6b8bb8f
SHA512

c49101a365f682b60ee52186158fc34e44cc1bb42380f76bc7a150c05ce7636ecabe760d615c34be0fcea5cb4f5f70e0c87d7e327cba828b481d21338e886e62
SSDEEP

12288:ILUlT0nEcmc7neyIgTWkmZJ5MH4c4oa9Tv3QHUHjYJiWY4y7+01neJykd+w4Ezib:r4n0cLebgiL7RcaY0kJz4+01nyzd+XDH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe

Files

6dc0d350d735fd1acc8219cfa5d02b9b.bin
.zip

Password: infected
2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe
.dll windows:6 windows x64 arch:x64

Password: infected

e78141e724292ad3a360b1a7baf7cfab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r560\r560_78\drivers\ui\uxd\bin\x64\Release\NvXDSyncPlugin.pdb

Imports

rpcrt4

IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrOleAllocate
NdrOleFree
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release

shlwapi

PathFindFileNameW

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetFileType
GetStdHandle
GetCurrentThread
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
VirtualAlloc
RtlUnwindEx
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
AreFileApisANSI
MoveFileExW
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
CloseHandle
GetLastError
SetLastError
GetSystemDirectoryW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
VerifyVersionInfoW
ExpandEnvironmentStringsW
GetFileSizeEx
WriteFile
OutputDebugStringW
EncodePointer
DecodePointer
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
FindFirstFileExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexW
CreateEventA
CreateEventW
OpenEventW
Sleep
WaitForMultipleObjects
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
ProcessIdToSessionId
GetSystemTimeAsFileTime
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
SetDllDirectoryW
MultiByteToWideChar
WideCharToMultiByte
DuplicateHandle
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateSemaphoreA
WTSGetActiveConsoleSessionId
GetVersionExW
TerminateProcess
GetLocaleInfoW
IsValidCodePage
GetACP
GetCommandLineA
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetStdHandle
ReadConsoleW
WriteConsoleW
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
GetProcessHeap
DeviceIoControl
SetFilePointerEx
RemoveDirectoryW
FindNextFileW
FindClose
DeleteFileW
CreateDirectoryW
FormatMessageA
SystemTimeToFileTime
CreateWaitableTimerA
GetModuleHandleA
GetLogicalProcessorInformation
ResumeThread
SetWaitableTimer
OpenEventA
GetCPInfo
LCMapStringW
CompareStringW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead

advapi32

RegEnumValueW
RegQueryValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoRevokeClassObject
CoTaskMemFree
CoCreateInstanceEx
CoRegisterClassObject
CoTaskMemRealloc
CoSuspendClassObjects
CoInitializeEx

oleaut32

SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi

Exports

Exports

NvPluginGetInfo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 255B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 437KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e78141e724292ad3a360b1a7baf7cfab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

shlwapi

kernel32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.orpc Size: 512B - Virtual size: 255B

.rdata Size: 437KB - Virtual size: 436KB

.data Size: 52KB - Virtual size: 83KB

.pdata Size: 57KB - Virtual size: 56KB

.didat Size: 512B - Virtual size: 32B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.orpc
Size: 512B - Virtual size: 255B

.rdata
Size: 437KB - Virtual size: 436KB

.data
Size: 52KB - Virtual size: 83KB

.pdata
Size: 57KB - Virtual size: 56KB

.didat
Size: 512B - Virtual size: 32B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 11KB - Virtual size: 10KB