bewtlfmlzhutxmgobvwa[.]dll

Resubmissions

10/08/2026, 12:42

260810-pxaxnayfjc1

10/08/2026, 12:38

10/08/2026, 12:34

10/08/2026, 12:30

10/08/2026, 12:26

10/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

General

Target
bewtlfmlzhutxmgobvwa.dll
Size 1.2MB
Sample260810-ppmaqatwhy
SHA256 f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6
MD5 5ef7bf4ed52be2a6d5ebbcf3076fba5f
SHA1 9e03e983e26d4782a3fef0a6ebb47fdcd46974c9
SHA512 66d80b3505d3fce7f4b4f238affb000423b429ee75aa5cd757e0fb810d31d54e593a58bc019de7abc440ae9d4fbc60ca33f33a85ed9a4783e721e844dd263a37
SSDEEP 12288:bLL0VMmPPvq6NXRTp7A2jsb3yDbe7qDu6ZPIFqYUrIcOR5XQRd+V2z3hrAduEYR+:3KNPPTXRTK2+GmFMIcqQqVg3hrrFHRO
TLSH
T1A9459F16739802B9E17BE17DC9974A46E6B278054330E7CF03E496AA2F277E14A7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

bewtlfmlzhutxmgobvwa.dll

.dll 1.2MB

bewtlfmlzhutxmgobvwa.dll

IMPHASH 0dabd40aa2a4ec7b32954eefec89a3c1
SHA256 f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6
MD5 5ef7bf4ed52be2a6d5ebbcf3076fba5f
SHA1 9e03e983e26d4782a3fef0a6ebb47fdcd46974c9
SHA512 66d80b3505d3fce7f4b4f238affb000423b429ee75aa5cd757e0fb810d31d54e593a58bc019de7abc440ae9d4fbc60ca33f33a85ed9a4783e721e844dd263a37
SSDEEP 12288:bLL0VMmPPvq6NXRTp7A2jsb3yDbe7qDu6ZPIFqYUrIcOR5XQRd+V2z3hrAduEYR+:3KNPPTXRTK2+GmFMIcqQqVg3hrrFHRO
TLSH
T1A9459F16739802B9E17BE17DC9974A46E6B278054330E7CF03E496AA2F277E14A7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

65:d1:7d:58:b9:aa:27:a2:a1:4f:a7:59:8d:3e:1f:cc:7e:ab:92:2f:44:7b:04:85:42:15:0d:93:5a:58:08:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Sep 26, 2025

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2023 - Jan 16, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

454288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\plugins\watchdog\NvPluginWatchdog.pdb

wtsapi32

WTSQueryUserToken WTSQuerySessionInformationW WTSFreeMemory WTSUnRegisterSessionNotification WTSRegisterSessionNotification WTSEnumerateSessionsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathFileExistsW

kernel32

CreateEventW GetProcessTimes GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess GetProcessId GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW FreeLibrary GetProcAddress LoadLibraryW GetBinaryTypeW LocalAlloc WaitForMultipleObjects CreateThread GetModuleFileNameW VerSetConditionMask GetFileAttributesW GetFullPathNameW SetLastError CreateProcessA CreateProcessW GetModuleFileNameA GetModuleHandleW LoadLibraryExW VerifyVersionInfoW CreateDirectoryW WaitForSingleObject FindFirstChangeNotificationW FindNextChangeNotification DeleteFileW FindClose FindFirstFileW FindNextFileW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleHandleExW MoveFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW RemoveDirectoryW MultiByteToWideChar WideCharToMultiByte DeviceIoControl GetTimeZoneInformation HeapReAlloc SetConsoleCtrlHandler ReadConsoleW SetEndOfFile SetStdHandle ResetEvent SetEvent GetLastError CreateFileW CloseHandle ExpandEnvironmentStringsW LocalFree GetCommandLineW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize WriteConsoleW OutputDebugStringW RtlUnwind FindCloseChangeNotification FormatMessageA GetStringTypeW GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType ExitProcess GetCurrentThread HeapFree HeapAlloc GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegSetKeyValueW GetUserNameW RegDeleteValueW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW SetEntriesInAclW LookupAccountNameW SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid LogonUserW SetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW RegGetValueW RegQueryValueExW RegCloseKey

Name

.text

Size

965KB

Virtual Size

964KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

bewtlfmlzhutxmgobvwa.dll

wtsapi32

userenv

shlwapi

kernel32

shell32

ole32

advapi32

generic