Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1055836" data-attributes="member: 86910">Hello there. I have not much time this weekend. But just from checking this file vs the original version&#039;s entry point, it is clearly patched. The patched code is unreadable because it manipulates the stack pointer. The original NvStTest in contrast is clearly readable. This patch alone is reason enough to declare it as malware because it is a modification that has nothing to do there and the file hasn&#039;t been signed by the publisher. [USER=103400]@SkeletalDemise[/USER] is very spot on with observations and analysis.[SPOILER=&quot;some images from binary diffing&quot;]Entry point of clean NvStTest:[ATTACH=full]278370[/ATTACH]Entry point of manipulated NvStTest (cannot be decompiled):[ATTACH=full]278371[/ATTACH]BinDiff of both files[ATTACH=full]278368[/ATTACH]Diff for both files of PortEx,&nbsp; black byteplot on the left means same code/data. It is mostly the code near the entry point and some resources and the (missing) certificate that have been changed.[ATTACH=full]278369[/ATTACH]If this was a legitimate software update, you would expect something different:<ol>
<li data-xf-list-type="ol">not only entry point code changes</li>
<li data-xf-list-type="ol">certificate would be there</li>
<li data-xf-list-type="ol">code would be readable</li>
<li data-xf-list-type="ol">many functions with small differences due to recompilation (this file was not recompiled, some of the sections even have the same hash)</li>
</ol>[/SPOILER]This blacksoul rule detects msvcp140.dll. I would not take it seriously.</blockquote>

[QUOTE="struppigel, post: 1055836, member: 86910"] Hello there. I have not much time this weekend. But just from checking this file vs the original version's entry point, it is clearly patched. The patched code is unreadable because it manipulates the stack pointer. The original NvStTest in contrast is clearly readable. This patch alone is reason enough to declare it as malware because it is a modification that has nothing to do there and the file hasn't been signed by the publisher. [USER=103400]@SkeletalDemise[/USER] is very spot on with observations and analysis. [SPOILER="some images from binary diffing"] Entry point of clean NvStTest: [ATTACH type="full" alt="mainfun_clean.png"]278370[/ATTACH] Entry point of manipulated NvStTest (cannot be decompiled): [ATTACH type="full" alt="mainfun_mal.png"]278371[/ATTACH] BinDiff of both files [ATTACH type="full" alt="bindiff.png"]278368[/ATTACH] Diff for both files of PortEx, black byteplot on the left means same code/data. It is mostly the code near the entry point and some resources and the (missing) certificate that have been changed. [ATTACH type="full" alt="diff_portex.png"]278369[/ATTACH] If this was a legitimate software update, you would expect something different: [LIST=1] [*]not only entry point code changes [*]certificate would be there [*]code would be readable [*]many functions with small differences due to recompilation (this file was not recompiled, some of the sections even have the same hash) [/LIST] [/SPOILER] This blacksoul rule detects msvcp140.dll. I would not take it seriously. [/QUOTE]

Verification