2_nvml.dll.zip
- SHA256 42345c3b9115433c2625a7358a1d735ecf0af890c1ea5882c054c565ad862502
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
nvml.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral2
Sample
nvml.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
8 signatures
900 seconds
General
- Target 2_nvml.dll.zip
- Size 309KB
- Sample260708-h5pbpadt2k
- SHA256 42345c3b9115433c2625a7358a1d735ecf0af890c1ea5882c054c565ad862502
- MD5 2f590fa7e3cd566991eddb8f3564b4ec
- SHA1 3b9dfa8ff3ca9c1f4b2e2401d97a039f30ab7259
- SHA512 ec3e52676febbb690deaaf2e8f303237312d7490abd99a16d507c39cdba787f43a5413717a5fe449cdf51b9b8b28c135e6a213eed1f8f128f97b80e603ee04db
- SSDEEP 6144:xULct0WKqYMjUoLBCvySUds5B2SVJvHFNpKagMvBPi/XpLSThpIpUqxT4V:MtMVBCvKk2AvlJRSNSThpIp+
- TLSH T18D6423E7B84663E49E3FB0353AA369905CB10CF176DFC7BA404DB6AE24B311CA586075
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack003/nvml.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/nvml.dll
File Explorer
-
2_nvml.dll.zip.zip 309KB
-
RKM-20260614-1514.zip.zip 310KB
-
RKM-20260614-1514/RKM-20260614-1514.img.iso 678KB
-
Tax_Notice_62850.exe.exe 287KB
-
nvml.dll.dll 327KB
RKM-20260614-1514.zip
- SHA256 01d63fac83c1e47461c08f5abfe29db0ddfe6b448b1abd7c21cfb8b06c4ad386
- MD5 863b1875d6bc86482b3794a5e67b52dd
- SHA1 40996c5f1d24502668726d37ebd27f2b6eac785c
- SHA512 14a94a049be70b1a7190cec602c7b98e28092427f4613627f4d3aed95860bc6e745991d2ee6265f7dd1a73bb07e78c0ebc1997ec55b16323eb2c7f3e2c620de1
- SSDEEP 6144:ruoaM2F6qMP2GTgZDtER5mTHB1xA/M/ri+WJCcZTZwFz/nsZjyJyBr:ruHM2tH9Tq/kri76UGJyBr
- TLSH T19B6423378D796CCBDCAADB3D0462E1F450F5C6055A8E79FDC652A9B20B5C929000B8FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
RKM-20260614-1514/RKM-20260614-1514.img
- SHA256 86e059af583e0efe2dc56592e530e30d8f4661d0023786accbbac6fc88604fdb
- MD5 b2c563a36382f9bfd6a3e1d1bea6997e
- SHA1 7c0f792d18cf29f19c24dbe3b389f105d0283c26
- SHA512 0d8b8d1059a3b27354fbfc09be1bfd8b7dcd4585005178f19172efe9c372e1c5559941f079f7127e4db72d607a737aa2e76edb19d4aa7231654ee71cf3783ba8
- SSDEEP 12288:xCPYSkEuZlyjMD17H03wbuH771Nfhu+1mqTnNFm:xCwS7uZlyjMDVUAbub5DLTr
- TLSH T130E4BE40F681BEF6DCA98A7825E12309E7B2B0044328E72F3A5CEE6D4F176549D37785
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Tax_Notice_62850.exe
- IMPHASH e94c291cbf7f11ed5641bc513cd6a0f8
- SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
- MD5 c9afda4f027fc9510134cffcc4d54da3
- SHA1 c5b5fb5f06d1f6cf98afa0df97f57e9bd7b454ed
- SHA512 91fc95c20e93059a470c5d6506ce368581679cb7b43216b44a5a1f2e440eee1729523935943226ad488a98cfc7ac7ce5888bae01ed359962feb3eb01e9b8e458
- SSDEEP 6144:/bMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmU:/71Nfhu+1mqTnNFmU
- TLSH T15A547D81FB866EFAEC79447C8AF1662AFB70B0180364C35B26989097DF133915D3A3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
fb:f1:b6:55:9f:d0:4f:3b:8f:d4:c4:12:f6:8a:b5:72:1b:2e:45:39:02:93:72:69:74:cf:23:8f:4f:49:39:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 19, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
fb:f1:b6:55:9f:d0:4f:3b:8f:d4:c4:12:f6:8a:b5:72:1b:2e:45:39:02:93:72:69:74:cf:23:8f:4f:49:39:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 21, 2023
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cf:52:36:be:71:4b:cd:48:ca:00:01:00:00:01:cf
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
2
Major OS version
5
Entry point
81172
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReleaseMutex
WaitForSingleObject
CreateMutexA
CloseHandle
CreateFileA
GetLastError
ReadFile
WriteFile
SetFilePointer
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
HeapAlloc
HeapFree
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSetInformation
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
nvml
nvmlDeviceGetCount_v2
nvmlDeviceGetHandleByIndex_v2
nvmlDeviceGetName
nvmlDeviceGetSerial
nvmlDeviceGetUUID
nvmlInit_v2
nvmlErrorString
nvmlInternalGetExportTable
nvmlShutdown
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=257, productName=VS2019 v16.9.2 build 29913, version=29913,
count=35, id=132, productName=VS2008 build 21022, version=21022,
count=10, id=149, productName=VS2008 build 21022, version=21022,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=101, id=1, productName=Unmarked objects,
count=186, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
nvml.dll
- IMPHASH 892f052923d075e566e8cbb4332dc552
- SHA256 436e791e379f21c0dc55597e739466158cd343fab9da528d1b5b586518268cd7
- MD5 cfa9492129a8b3e4e859097de41f6d58
- SHA1 2373c7d4df16cb28bb626f8d52ab3887690ed08a
- SHA512 612f32aeb4fa0c85139ed3d31181bcc7943cd825b51c6f87e8cf3a335b1a7e77e8b2f76cfff1c2111402d409f97299b165edc00f8d4d2bd6a8990f647964c409
- SSDEEP 6144:p3n7CamhS+OKnkh2TKVu7Hy6iZl2jP/PMDvqmbKHszHev3wwUut9tlbqqqG:FCPYSkEuZlyjMD17H03wbuHx
- TLSH T1CF647C50B251FEB5DC8A8FB421E22349D3E6B041971DB93F6A20FF3C025EA68D573A45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegCreateKeyExW
RegSetValueExW
kernel32
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
FreeConsole
GetCurrentThread
GetEnvironmentVariableW
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
QueueUserAPC
ReadFile
SetFileAttributesW
SetFilePointer
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
lstrcatW
lstrlenW
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
shell32
ShellExecuteExW
user32
SetProcessDPIAware
wsprintfW
nvmlDeviceGetCount_v2
nvmlDeviceGetHandleByIndex_v2
nvmlDeviceGetName
nvmlDeviceGetSerial
nvmlDeviceGetUUID
nvmlErrorString
nvmlInit_v2
nvmlInternalGetExportTable
nvmlShutdown
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nvrdat
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nvdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
325B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nvrdat
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nvrdat
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nvrdat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.bss
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.nvrdat
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.nvtext
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.nvrdat
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
765B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.nvdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.nvdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ