c96ec96ea29372311cbef1d2b23f0e51b06f1f6184a41da985142929d9fa2f02[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

c96ec96ea29372311cbef1d2b23f0e51b06f1f6184a41da985142929d9fa2f02.exe
Size

2.0MB
MD5

933e9c63811494279963276486c600a4
SHA1

c22863176e2d68ea9a27963e2ed8aa706910616a
SHA256

c96ec96ea29372311cbef1d2b23f0e51b06f1f6184a41da985142929d9fa2f02
SHA512

de8990be0a11f2be95ffbdeb8388259e6becc79bc6c9371df3b6cb3348ae07c4827edcc762a18e32af1e5cfde1ebf98f8711827b544bb802c1b2d94a902c8cc8
SSDEEP

49152:UnmL3YxQBxRpQrLESwW0eCPR+G54lC4iaoV0Z2HCv5:w5wYCV4iaoV0U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
c96ec96ea29372311cbef1d2b23f0e51b06f1f6184a41da985142929d9fa2f02.exe

Files

c96ec96ea29372311cbef1d2b23f0e51b06f1f6184a41da985142929d9fa2f02.exe
.dll windows:6 windows x64 arch:x64

e78141e724292ad3a360b1a7baf7cfab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_87\drivers\ui\uxd\bin\x64\Release\NvXDSyncPlugin.pdb

Imports

rpcrt4

IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrOleAllocate
NdrOleFree
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release

shlwapi

PathFindFileNameW

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetFileType
GetStdHandle
GetCurrentThread
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
VirtualAlloc
RtlUnwindEx
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
AreFileApisANSI
MoveFileExW
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
CloseHandle
GetLastError
SetLastError
GetSystemDirectoryW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
VerifyVersionInfoW
ExpandEnvironmentStringsW
GetFileSizeEx
WriteFile
OutputDebugStringW
EncodePointer
DecodePointer
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
FindFirstFileExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexW
CreateEventA
CreateEventW
OpenEventW
Sleep
WaitForMultipleObjects
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
ProcessIdToSessionId
GetSystemTimeAsFileTime
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
SetDllDirectoryW
MultiByteToWideChar
WideCharToMultiByte
DuplicateHandle
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateSemaphoreA
WTSGetActiveConsoleSessionId
GetVersionExW
TerminateProcess
GetLocaleInfoW
IsValidCodePage
GetACP
GetCommandLineA
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetStdHandle
ReadConsoleW
WriteConsoleW
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
GetProcessHeap
DeviceIoControl
SetFilePointerEx
RemoveDirectoryW
FindNextFileW
FindClose
DeleteFileW
CreateDirectoryW
FormatMessageA
SystemTimeToFileTime
CreateWaitableTimerA
GetModuleHandleA
GetLogicalProcessorInformation
ResumeThread
SetWaitableTimer
OpenEventA
GetCPInfo
LCMapStringW
CompareStringW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead

advapi32

RegEnumValueW
RegQueryValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoRevokeClassObject
CoTaskMemFree
CoCreateInstanceEx
CoRegisterClassObject
CoTaskMemRealloc
CoSuspendClassObjects
CoInitializeEx

oleaut32

SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi

Exports

Exports

Object

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 255B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 437KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 299KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e78141e724292ad3a360b1a7baf7cfab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

shlwapi

kernel32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.orpc Size: 512B - Virtual size: 255B

.rdata Size: 437KB - Virtual size: 437KB

.data Size: 52KB - Virtual size: 84KB

.pdata Size: 57KB - Virtual size: 56KB

.didat Size: 512B - Virtual size: 32B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 299KB - Virtual size: 299KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.orpc
Size: 512B - Virtual size: 255B

.rdata
Size: 437KB - Virtual size: 437KB

.data
Size: 52KB - Virtual size: 84KB

.pdata
Size: 57KB - Virtual size: 56KB

.didat
Size: 512B - Virtual size: 32B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 299KB - Virtual size: 299KB

.reloc
Size: 11KB - Virtual size: 10KB