C:\JenkinsLocalRoot\workspace\InstallerCore2017\sw\rel\gpu_drv\installer_core\installer_core_vs2017\Build\Core\Out\Win32\Release\setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
79348af82dd8ddb40449df516db901d83c72ef6f3e16677eb8a8950c9a6f6dc0.exe
Resource
win7-20241023-en
General
-
Target
79348af82dd8ddb40449df516db901d83c72ef6f3e16677eb8a8950c9a6f6dc0
-
Size
641KB
-
MD5
24195eafbd6a87c96f4302cf215ddc6b
-
SHA1
4df2017d374269076238c41bd499928ba699dae2
-
SHA256
79348af82dd8ddb40449df516db901d83c72ef6f3e16677eb8a8950c9a6f6dc0
-
SHA512
ccb070a93b8cec90a88ccc296604548ffd05b4c5cb5c7cf208d8e31af34df28ef6d73f9c4419594c1349ba619848b4359ed070c2ec1c60a1c141f39366218986
-
SSDEEP
12288:HYlRfNVdSdwFPuMpeFFD9Sg5oBUPCVKL7267HhAjhyKyVkKB0HaFAx6T:HmAXMpeFFZS83/H6Uj4Ao6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79348af82dd8ddb40449df516db901d83c72ef6f3e16677eb8a8950c9a6f6dc0
Files
-
79348af82dd8ddb40449df516db901d83c72ef6f3e16677eb8a8950c9a6f6dc0.exe windows:6 windows x86 arch:x86
bc3ccea92cc1a4956d4998d0784ae777
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetDefaultDllDirectories
CreateEventW
CloseHandle
RaiseException
DecodePointer
SetLastError
DebugBreak
Sleep
IsDebuggerPresent
EnterCriticalSection
GetCurrentProcess
LeaveCriticalSection
GetVersionExW
LocalFree
FormatMessageW
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
WideCharToMultiByte
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SetErrorMode
SizeofResource
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
MultiByteToWideChar
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindNextFileW
GetFileAttributesW
GetTempPathW
GetCurrentThread
GetTickCount
GetSystemDirectoryW
lstrcmpW
DuplicateHandle
TerminateProcess
ExpandEnvironmentStringsW
LocalAlloc
VerSetConditionMask
GetFullPathNameW
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
VerifyVersionInfoW
GetSystemInfo
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitProcess
GetStdHandle
WriteFile
GetACP
GetFileType
LCMapStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
user32
MessageBoxW
advapi32
OpenProcessToken
GetTokenInformation
RegOpenCurrentUser
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
LsaNtStatusToWinError
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
oleaut32
SafeArrayGetVartype
SafeArrayCopy
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayCreate
VariantClear
VariantInit
SafeArrayDestroy
SysStringLen
VariantChangeType
SysAllocStringLen
SysAllocString
SysFreeString
Sections
.text Size: 345KB - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ