sample.7z
- SHA256 27b2e13bfcb8de5078f1f8c0af861e513161c0e17812a9776911073d79742924
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
sample.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
sample.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target sample.7z
- Size 1.7MB
- Sample260820-jdwgcsvwct
- SHA256 27b2e13bfcb8de5078f1f8c0af861e513161c0e17812a9776911073d79742924
- MD5 e5a6df9fd02274a9ac50de6d44484cda
- SHA1 0019d4775ccbbdc2fff708278caecce4741e2aa9
- SHA512 3aa2a4045536b94d6ee11f0343cea2f9163a7a072abf6a8efed2d77cf937080c8ca29274e59036788962268a8738571497ae6ca640b21ec1e25c2decb6995dd5
- SSDEEP 49152:YTea2NHBN29bTudcUGX+9OlCWzlNbmVe4X9JMrzDAFV3LiY2TmIe:wG2ZTuDkSoHsoDQiDTmr
- TLSH T10D8533F4C04351BB21A20EE87EF9768AC9D6710EE4A8D5A287538F1D1BE7492DC7C21D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/sample/NSecRpter.exe unpack001/sample/plugins/NvSmartMax64.dll unpack001/sample/vulkan-1.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/sample/plugins/NSecRpter.exe
File Explorer
-
sample.7z.7z 1.7MB
-
sample/NSecRpter.exe.exe 1.9MB
-
sample/TSMgrSvc.exe.exe 307KB
-
sample/plugins/NSecRpter.exe.exe 58KB
-
sample/plugins/NSecRpter.hlp12KB
-
sample/plugins/NvSmartMax64.bin658KB
-
sample/plugins/NvSmartMax64.dll.dll 69KB
-
sample/vulkan-1.dat658KB
-
sample/vulkan-1.dll.dll 98KB
sample/NSecRpter.exe
- IMPHASH 559cb907fe52b806b92168cb50dec34c
- SHA256 9c27490b0cf946eea337eaaef4bbf0487f26b16f81dbda0f24b31ec7d7e728d3
- MD5 864e7fb5f2ac4dbc75fd2b0452e94388
- SHA1 a711ab46635e3831faff779431c4371bb7ed8a37
- SHA512 abb7b86950418c1a16d3116e635f060eb418a60203ab3fa91acd2932e5f32fcda50938dfc0e39f501804fc5dc20b0831a4c6d16c5bf66b046055676cfc86ec4b
- SSDEEP 49152:kpojL/+cPZpJGmF+Ml7mbN6ZNjshcYpKkjsVc2ot4+Ej2ED+l3eFq8um+:LZpldnGMkjsVc2ot4+Ej2ED+l3eFqc+
- TLSH T1B0957D29F6488195C17AC17C8AD6CB4BE7B1B40D87359ACF508547DE0E63BE18D3EAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Minor OS version
0
Major OS version
6
Entry point
29216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\j\msdk\build\Khronos-Tools\repo\build\vulkaninfo\RelWithDebInfo\vulkaninfo.pdb
kernel32
Sleep
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryExA
LoadLibraryA
GetConsoleScreenBufferInfo
SetErrorMode
SetConsoleWindowInfo
SetConsoleTitleA
GetConsoleProcessList
HeapSize
CreateFileW
ReadConsoleW
SetConsoleScreenBufferSize
GetStdHandle
WideCharToMultiByte
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetProcessHeap
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringA
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEndOfFile
user32
LoadCursorA
MonitorFromWindow
gdi32
GetStockObject
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
386KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.cfguard
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
283B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=260, version=23917,
count=11, id=259, version=23917,
count=150, id=261, version=23917,
count=8, id=259, version=24123,
count=60, id=261, version=24123,
count=36, id=260, version=24123,
count=7, id=257, version=23917,
count=109, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
sample/TSMgrSvc.exe
- IMPHASH d4f40d7a4f67d61616c33bf507b96a18
- SHA256 5979e938ec2084ca35b5120a8712dd20578d80a3726fad04137414ea4379d9cf
- MD5 623f2e43bb07cc062e49e3b54980c371
- SHA1 1b8f46f72459fe873dae0b1e69cae6f26ceb8d33
- SHA512 09f897b90389299e1cd61c016a94019c2fd00b2b2b16e4723acf85061bc97c5f1968107e6c6bd3d1be9fb33ba0f8231624dda5a3704bcad2dad22cb0439f6052
- SSDEEP 3072:Qf28UEmZ23+tTuHl827WZBe/XTAKiI/xOiyrDkYqc4Ui+L99999994IE9CHO9z:Qf2DxFEiBayr4QpSIiCHOZ
- TLSH T103642D4ABFC340B1D03D0674C963B55D8534A9E0367025E77AC8621ABDF2188BDEBE6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3e:4a:c4:66:d7:3b:56:04:42:78:76:03:01:48:cd:a3:61:fa:e0:5d:ca:2c:dc:b9:cc:71:49:e0:06:58:d2:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Mar 1, 2024
SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 2, 2023 - May 2, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
33162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\NSecsoft\NSec\Release\Server\Server\TSMgrSvc.pdb
kernel32
OpenMutexW
TerminateThread
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
CreateMutexW
GetExitCodeProcess
DecodePointer
WriteConsoleW
HeapReAlloc
HeapSize
FlushFileBuffers
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
CreateProcessW
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetSystemDirectoryW
WaitForSingleObject
CopyFileW
GetLastError
GetModuleFileNameW
GetVersionExW
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryDosDeviceW
GetLogicalDrives
HeapFree
SetLastError
FindNextFileW
WriteFile
FindClose
CreateFileW
GetModuleHandleA
OpenProcess
CreateFileA
HeapAlloc
LocalFree
GetProcessHeap
GetTickCount
LoadLibraryExW
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
GetFileType
user32
wsprintfA
advapi32
ConvertSidToStringSidW
RegOpenKeyExW
GetTokenInformation
RegQueryValueExW
OpenServiceW
StartServiceW
DeleteService
OpenSCManagerW
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
ControlService
ChangeServiceConfig2W
QueryServiceStatus
CreateServiceW
RegCloseKey
OpenProcessToken
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
shlwapi
PathFindFileNameA
SHSetValueA
StrCmpIW
wvnsprintfA
wnsprintfA
PathAppendW
SHSetValueW
PathFileExistsW
wnsprintfW
SHGetValueW
ws2_32
WSAStartup
psapi
GetModuleFileNameExW
shell32
SHCreateDirectoryExA
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=152, id=243, version=40116,
count=25, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=312, id=1, productName=Unmarked objects,
count=16, id=265, version=27051,
count=1, id=255, version=27051,
count=1, id=151,
count=1, id=258, version=27051,
sample/plugins/NSecRpter.exe
- IMPHASH f0c02ac1a159ec37094ebd511be81131
- SHA256 935451efded98cb8e92852b87bb9a6ca240053bec8bcb2cd847636a5f45d3d17
- MD5 b2980d7e5441f4f83295e227dcaad9f1
- SHA1 76a022cc078b6abe5f2c98f12fc533ba035d9bd5
- SHA512 bdfae7b5db5ee71bdfb9b44b565312dd9985d1e62616dea5cd0ab3748921c8542ef2381fe21aae24f1fe4058819557e194e429d3c25fd01746697e22166a782c
- SSDEEP 768:jij6FyFt1yqxaW2LfFwZgVX6zqf8SrBiqcXHyEoTjppGum4dp9QyDn5jk6:j41Oxw6X63YBiqc3yEItpG14355jJ
- TLSH T13C436B9A775040FAD8538278CDF29A4AF672F4564BB1434F0638C2A66F237E16B2E315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2f:ae:1c:ab:15:31:50:0e:d7:ab:a4:7e:80:e6:4d:e9:e8:72:f3:ef
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Jan 30, 2015
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 6, 2014 - Sep 7, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
2
Major OS version
5
Entry point
6792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
RegisterClassExW
DefWindowProcW
EnumDisplayMonitors
PostQuitMessage
EqualRect
FindWindowW
SendMessageW
GetDC
ReleaseDC
MonitorFromRect
GetMonitorInfoW
SubtractRect
SystemParametersInfoW
InvalidateRect
GetWindowRect
IsRectEmpty
OffsetRect
SetWindowPos
CreateWindowExW
ShowWindow
UpdateWindow
nvsmartmax64
NvSmartMaxNotifyAppHWND
kernel32
WideCharToMultiByte
FlushFileBuffers
CreateFileA
HeapSize
HeapReAlloc
HeapAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
MultiByteToWideChar
HeapFree
IsValidCodePage
GetCurrentThreadId
CloseHandle
GetLastError
CreateMutexW
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=32, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=121, id=1, productName=Unmarked objects,
count=93, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
sample/plugins/NSecRpter.hlp
- SHA256 37d313b2e4d72a87b57139e1c204d038698c027a7f96cbd24ce892483af95722
- MD5 2cf2d2722937feac117c598284752edb
- SHA1 01c544351365c033ecc62e0d42335a1a8e3edd2c
- SHA512 8f33467de711e60678ff5bfe40c6d38fd87bda0c821a7626fba12d59f1fe38a2d4bbecd0fbfc4a988d0b2899e2db601fac8eb272ca4f03508d1bca081087f871
- SSDEEP 384:u3jgFyK0W3jgDyKDKCWKgyKgbBPKerrC0fyUPyUby7F1D6afDTWy7qyUp1DBSjS7:u3jgFyKn3jgDyKDKCWKgyKg1PKevC0f/
- TLSH T1C242F880D6F9D588C67ADC3D7ADE13876CAD7B01FB000063443B817FA1AF545A9B6B86
- MD5 SHA1 SHA512 SSDEEP TLSH
sample/plugins/NvSmartMax64.bin
- SHA256 6f61ce4d6043c999dffe375390f132809b046b1517b85ee177a3797c10e0a713
- MD5 bf7c89abe7afd049fde30a13134a1355
- SHA1 0eed1f11ffea85bbc829d4671c28d9e72d40e6d4
- SHA512 42f8819ac5e62fd21fbfcd93affd5c534fe6cb1f6fb57a1de3830f4afdbf52ce8d1f6b7f3abc230d9402a6ddf6ed84f9dbece1f997cbb04cacd64966ecf80d5e
- SSDEEP 12288:ew0kORz4L1cpbMLYHswBz79LMwW9uw7ZVC+adwykwmqHwrIlOa7wdYZgwnjX:l3mSLYH9Bz79Qw0NV+PqI0utX
- TLSH T1F5E423EA91735B736249471AC1F86563F80CE75C3807CA3495BDF181A2C83A7ABDC1AD
- MD5 SHA1 SHA512 SSDEEP TLSH
sample/plugins/NvSmartMax64.dll
- IMPHASH 0c46e84e64ec6188f9a4191a59fb9e43
- SHA256 46eef7aae025e4279cae795b22be9cd0c4055dbf4c2f569d8b54400cecbb046a
- MD5 b033a453d004ba534610df1ad41b1028
- SHA1 eb92b0067e81519719151417e907e42d639f08c5
- SHA512 1445639796e89476e988b50e697db5f838a6770330ac9c9e13349e5706f246416280df2971e9b2537b35283ad11dca293b15fbcfb46f67ffe474e2a879f64958
- SSDEEP 1536:CHDAnuzSAxALCbUwLVxTdLEN3q7f2g1LMvRk:CHDAnuBxALCbUgZLTf/IK
- TLSH T18A636237C11499EEC3EBC9F492611A5784757D0ECF3A23AB936233552B246A0E72C375
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4980
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
WideCharToMultiByte
lstrcatW
lstrlenW
msvcrt
?terminate@@YAXXZ
__C_specific_handler
__CppXcptFilter
__CxxFrameHandler3
__getmainargs
_initterm
_initterm_e
fclose
fopen
fread
free
fseek
ftell
malloc
memcpy
memset
rewind
NvSmartMaxNotifyAppHWND
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
sample/vulkan-1.dat
- SHA256 6d9a4e5b1ce0610b109f8301aba58b9c3dc831c3aee2c2fe689a10f83b1de496
- MD5 e8e6cdd40c77424a793de5b2fc7096e7
- SHA1 323fc1fff5455ae26b5a2867214d871c4a8c81ed
- SHA512 a0630ac6aa1351e3274d1d991465e8a57be29f857d72e3643af15c51072515122a0113b74c1257b718503fae6763006739bb12dc23570b87fe514920eb96b7fe
- SSDEEP 12288:Y4gyaLjSuCPVW7NSI6BuDcVmcSI5hfvLNIL//xg2OYjI6+lXuv579Wzk2tTA:+xSInDKniL//xOYx+w57Bj
- TLSH T1E0E423C73112DB271A01C7307447BA33F2E856FB25F97432BA46F162560BF6AAE72446
- MD5 SHA1 SHA512 SSDEEP TLSH
sample/vulkan-1.dll
- IMPHASH d21396fad42f270c8d1a28a5514b5bf1
- SHA256 1fa10925a69425f3ff36f3b0f0c35482502fbe3fe8a57be280bfd23f193bf56f
- MD5 b7e81b16a40b6c97f5c9608771611405
- SHA1 07374db2326a001b66c9e5330115ad14d2260b08
- SHA512 901e70089f30cb8c7fb01b4a479c8786d141803cb7ed9cff19bbe2a27bb632fce56de30cfb426a7d296ea72ecd475f86d693a6cb40d3d7ff5ea5d51bada5f00e
- SSDEEP 1536:XRdaq9CozvFivTZylPZrdDlTf3zMFJjhJjQYIX6G:vNvwv9ytB6jhtQYVG
- TLSH T1E8A33B1DB2E330A9C5A6C03196A25276FA72F43454256BDE4354CB762FE6C703BED2E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateMutexA
CreateSemaphoreA
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindAtomA
FormatMessageA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameW
GetProcessAffinityMask
GetProcessTimes
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler
lstrcatW
lstrlenW
msvcrt
__iob_func
_amsg_exit
_beginthreadex
_endthreadex
_errno
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
fclose
fopen
fprintf
fread
free
fseek
ftell
longjmp
malloc
memcpy
memmove
memset
realloc
rewind
signal
strlen
strncmp
vkEnumerateInstanceVersion
Name
.text
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
90B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=42, id=131, version=30319,
count=15, id=132, version=30319,
count=1, id=2, version=30319,
count=3, id=1, productName=Unmarked objects,
count=8, id=15, version=30319,