DOCSLIB.ORG

Automated Malware Analysis Report for Hwi 700.Exe

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Automated Malware Analysis Report for Hwi 700.Exe ID: 373541 Sample Name: hwi_700.exe Cookbook: default.jbs Time: 01:19:32 Date: 23/03/2021 Version: 31.0.0 Emerald Table of Contents Table of Contents 2 Analysis Report hwi_700.exe 5 Overview 5 General Information 5 Detection 5 Signatures 5 Classification 5 Analysis Advice 5 Startup 5 Malware Configuration 5 Yara Overview 6 Sigma Overview 6 Signature Overview 6 Data Obfuscation: 6 Lowering of HIPS / PFW / Operating System Security Settings: 6 Mitre Att&ck Matrix 6 Behavior Graph 7 Screenshots 8 Thumbnails 8 Antivirus, Machine Learning and Genetic Malware Detection 9 Initial Sample 9 Dropped Files 9 Unpacked PE Files 9 Domains 10 URLs 10 Domains and IPs 11 Contacted Domains 11 URLs from Memory and Binaries 11 Contacted IPs 15 Public 15 Private 15 General Information 15 Simulations 16 Behavior and APIs 16 Joe Sandbox View / Context 17 IPs 17 Domains 17 ASN 17 JA3 Fingerprints 17 Dropped Files 17 Created / dropped Files 17 Static File Info 23 General 24 File Icon 24 Static PE Info 24 General 24 Authenticode Signature 24 Entrypoint Preview 24 Data Directories 25 Sections 26 Resources 26 Imports 27 Version Infos 27 Possible Origin 27 Network Behavior 28 UDP Packets 28 Copyright Joe Security LLC 2021 Page 2 of 48 Code Manipulations 29 Statistics 29 Behavior 29 System Behavior 29 Analysis Process: hwi_700.exe PID: 5524 Parent PID: 5656 29 General 29 File Activities 29 File Created 29 File Deleted 30 File Written 30 File Read 30 Analysis Process: hwi_700.tmp PID: 3176 Parent PID: 5524 31 General 31 File Activities 31 File Created 31 File Deleted 32 File Moved 32 File Written 32 File Read 35 Registry Activities 36 Key Created 36 Key Value Created 36 Analysis Process: svchost.exe PID: 68 Parent PID: 568 39 General 39 File Activities 39 Analysis Process: svchost.exe PID: 4456 Parent PID: 568 39 General 39 File Activities 39 Registry Activities 40 Analysis Process: svchost.exe PID: 6048 Parent PID: 568 40 General 40 File Activities 40 Analysis Process: svchost.exe PID: 4604 Parent PID: 568 40 General 40 Analysis Process: svchost.exe PID: 2344 Parent PID: 568 40 General 40 File Activities 41 Analysis Process: svchost.exe PID: 1320 Parent PID: 568 41 General 41 File Activities 41 Analysis Process: svchost.exe PID: 5540 Parent PID: 568 41 General 41 Registry Activities 41 Analysis Process: svchost.exe PID: 6160 Parent PID: 568 42 General 42 Analysis Process: SgrmBroker.exe PID: 6240 Parent PID: 568 42 General 42 Analysis Process: svchost.exe PID: 6252 Parent PID: 568 42 General 42 File Activities 42 Analysis Process: svchost.exe PID: 6276 Parent PID: 568 43 General 43 Registry Activities 43 Analysis Process: HWiNFO64.EXE PID: 6404 Parent PID: 3176 43 General 43 File Activities 43 File Created 43 File Deleted 43 File Written 44 Registry Activities 45 Key Created 45 Analysis Process: svchost.exe PID: 6592 Parent PID: 568 45 General 45 File Activities 45 Analysis Process: MpCmdRun.exe PID: 6256 Parent PID: 6276 46 General 46 File Activities 46 File Written 46 Analysis Process: conhost.exe PID: 5720 Parent PID: 6256 47 General 47 Disassembly 48 Code Analysis 48 Copyright Joe Security LLC 2021 Page 3 of 48 Copyright Joe Security LLC 2021 Page 4 of 48 Analysis Report hwi_700.exe Overview General Information Detection Signatures Classification Sample hwi_700.exe Name: DDeettteeccttteedd uunnppaacckkiiinngg (((cchhaannggeess PPEE ssee… Analysis ID: 373541 CDChehataenncggteesds susenecpcuuarrrciiittktyyi n ccgee n(ncttteherrar snsegettettttiisinn gPgssE (( (nsnoeo… MD5: f332037f0b58957… ACAVhV a ppnrrrgooeccese sssse scstuttrrrriiinintgyg ssc efffoonuutennrdd s (((eootfffttttienengn s uu s(sneeo… SHA1: 31dcf1615b32730… Ransomware AAnVnttt iiipvviriirroruucsse osorsrr Mstaraicnchhgiiisnn eefo LLueenaadrrr n(noiiinnftgge ndd eeutttseeecc… Miner Spreading SHA256: c42c2a82438dc7… CAChnheteivccikkrsus s iiif ff o AArn nMtttiiivaviicirrruhusisn///AeA nnLttteiiissapprynywwinaagrrr eed///eFFtiieirrrece… mmaallliiiccciiioouusss Infos: malicious Evader Phishing CCohonentctaakiinsn ssif ccAaanpptaiavbbiriiluliittsiiee/Ass n ttotoi s ddpeeyttweecactrt evv/iirFrttuiuraea sssuusssppiiiccciiioouusss CCoonntttaaiiinnss ccaappaabbiiillliiitttiiieess tttoo ddeettteeccttt vviiirrrtttuuaa… suspicious Most interesting Screenshot: cccllleeaann CCoonntttaaiiinnss ffcfuuannpccatttiibiooinlnitaaiellliiitsttyy t tottoo d aaecctcececests svs i lrllootuaaadd… clean Exploiter Banker CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo cacacallcllll e nnsaasttti iivlvoeea ffdf… CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo cchahelel ccnkka itiiffif v aae w wf… Spyware Trojan / Bot Adware CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo ccohomecmk uuifnn aiiicc awa… Score: 26 Range: 0 - 100 CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo dcdyoynmnaammuiiicncaaiclllllalyy… Whitelisted: false CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo lldlaayuunnnaccmhh i aca a ppllrrry… Confidence: 60% CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo qlqauuueenrrrcyyh lllo oacc apallrlee… CCoonntttaaiiinnss fffuunncctttiiioonnaallliiitttyy tttoo sqshuhueuttrtddyo olwowcnna //l/ e … CCrroreenaattatteeinss s aa f uppnrrroocctcieoesnsssa liiinnty s stuuoss sppheeunntddeeoddw mn o/o … Analysis Advice CCrrreeaattteess dadrr ripiivvreeorrrc ffefiiillsleesss in suspended mo CCrrreeaattteess ffdfiiillrleeivsse iiirnn sfsiiliidedese ttthhee ssyyssttteem ddiiirrreecc… Sample drops PE files which have not been started, submit dropped PE samples for a secondCCarreeyaa atteenssa flfiyilleesssis iin ntsosii ddJeeo tethh eSe a ssnyysdstbteeomx ddiirreecc… Creates files inside the system direc Sample tries to load a library which is not present or installed on the analysis machine, addinDCDge retetthteaeectce tttleesibd df r i plapeorosyttt ee inmnstttiiiagdallhel cc ttr rrhyryeppv tttsooey affsfuult nenmcmctottii iorodennir ebcehavior DDrrerootpepscs t PePdEE p fffiioillleetessntial crypto function EDEnrnoaapbbslllee Pss E dd rrrfiiivlveeesrrr pprrriiivviiillleeggeess EExnxttateebnnlsesiisivv eed ruuivsseer oopfffr GivieeletttPgPrerroosccAAddddrrreessss (((oo… FEFoxoutuennndds didvrrreoo puppspeed do PfP GEE e fffiitillPlee r wowchhAiiiccdhhd hrheaassss n n(oo… Startup FFoouunndd edevrvoaapsspiiivveeed A APPPEIII cfcihlheaa iwiinnh (((idcdahat ttehe a ccshh enecockk))) FFoouunndd pepovotatteesnnivtttiieiaa lllA ssPtttrrrIiii nncggh addienec c(rrrdyyappttteiiioo ncnh ///e aac…k) System is w10x64 hwi_700.exe (PID: 5524 cmdline: 'C:\Users\user\Desktop\hwi_700.exe' MD5: F332037F0BMF5oa8auy9yn 5 ssd7llle eDpeeo2ppt4 e ((F(nee6tvviDaalsEs siiiCvvtere2i n 7lllogoEo od9ppe1ssc2))) r 2 tytto8op 7 hthi)oiiinnndd e/e rarr … hwi_700.tmp (PID: 3176 cmdline: 'C:\Users\user\AppData\Local\Temp\is-1PO0H.tmp\hwi_700.tmp' /SL5='$11021C,8777995,123392,C:\Users\user\Desktop\hwi_700.exe' Moaonyni iittstoolerrrsse pcce e(rrertttavaaiiinns irrrveeegg iilisosttotrrrypy s kk)ee tyyoss h /// i nvvadalelluur… MD5: 751D4F1D0F96F1DF71F778391555E52B) HWiNFO64.EXE (PID: 6404 cmdline: 'C:\Program Files\HWiNFO64\HWiNFO64.EPXMPEEo ' n fff iiiMlltleeo D rccs5oo c:nn e5tttaar9tiiinaFnsi9sn Ba arAnen g1 iiininDsvvt2araDylllii idCdk e 4ccyh9hse0e cA/c kvk5sas1uulEum3779EB26D8F9A3) svchost.exe (PID: 68 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA) PPEE fffiiilllee ccoonntttaaiiinnss eaexnxe eicncuvutattaalbibdllle ec hrrreesscookusurrurccmee… svchost.exe (PID: 4456 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA) svchost.exe (PID: 6048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32PP5E6E9 fffEiiilllee4 0cc3oo2nn7tttaa9iiinBns3s FsestDtxtrrrae2ancEnuggDteeaB brrr7eeleEss oBoreuuDsrrrc0oce3eus6src2e73FA) svchost.exe (PID: 4604 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA) QPEuue efrrirliiiee ssc oddniiisstkak i iniinnsfffo osrrrtmraaantttigiiooenn r ((e(oosffftotteeunnr c uuessseedd… svchost.exe (PID: 2344 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA) svchost.exe (PID: 1320 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDQPuuSeevrrrciiiee Mss Dttdthhi5ese:k v3v io2onll5lfuuo6mr9meeE a i4iintni0foffo3onrr2r m(7oa9aftBttieiioo3nnnF u D(((nsn2eaaEdmD…B7EBD036273FA) svchost.exe (PID: 5540 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA) SQSaaumerppielllees eethxxee ccvuuotttliiiuoomnn esst ttoionppfoss r wmwhhaiiitllleieo npp rrr(oonccaeem… svchost.exe (PID: 6160 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA) SgrmBroker.exe (PID: 6240 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170ASS3aaFm3ppAllle9e 6 ffefii2illxlee6e 5iiciss9u d7dtiiEioiffffffnEee rErrseet1non8ttpt 8 ttsth8h aw6an8nh 6 ioloeErrri i3igpgEiirinnoAaac6llel )… svchost.exe (PID: 6252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA) SSttatoomrrreepssl e fffi iillfleielses tittoso dttthhifeefe Wreiinintdd toohwwasns sosttrtaaigrrrtitt n maele … svchost.exe (PID: 6276 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrSeStstootrrieecstse ffdiille e-sps t-toos twthhseec Wsviicnn ddMooDww5ss: ss3tta2ar5rtt 6 m9eEe…403279B3FD2EDB7EBD036273FA) MpCmdRun.exe (PID: 6256 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.TSTerrtrxiioieers'se - stttwoo f d illloeoasnad adt ob m lteiihis seMss iiinWDngg5i
Load more

Recommended publications
  • Reviving the Development of Openchrome
    Reviving the Development of OpenChrome Kevin Brace OpenChrome Project Maintainer / Developer XDC2017 September 21st, 2017 Outline ● About Me ● My Personal Story Behind OpenChrome ● Background on VIA Chrome Hardware ● The History of OpenChrome Project ● Past Releases ● Observations about Standby Resume ● Developmental Philosophy ● Developmental Challenges ● Strategies for Further Development ● Future Plans 09/21/2017 XDC2017 2 About Me ● EE (Electrical Engineering) background (B.S.E.E.) who specialized in digital design / computer architecture in college (pretty much the only undergraduate student “still” doing this stuff where I attended college) ● Graduated recently ● First time conference presenter ● Very experienced with Xilinx FPGA (Spartan-II through 7 Series FPGA) ● Fluent in Verilog / VHDL design and verification ● Interest / design experience with external communication interfaces (PCI / PCIe) and external memory interfaces (SDRAM / DDR3 SDRAM) ● Developed a simple DMA engine for PCI I/F validation w/Windows WDM (Windows Driver Model) kernel device driver ● Almost all the knowledge I have is self taught (university engineering classes were not very useful) 09/21/2017 XDC2017 3 Motivations Behind My Work ● General difficulty in obtaining meaningful employment in the digital hardware design field (too many students in the field, difficulty obtaining internship, etc.) ● Collects and repairs abandoned computer hardware (It’s like rescuing puppies!) ● Owns 100+ desktop computers and 20+ laptop computers (mostly abandoned old stuff I
    [Show full text]
  • Hoja De Datos De Familes Del Procesador Intel(R) Core(TM) De 10A Generación, Vol.1
    10a generación de familias de procesadores Intel® Core™ Ficha técnica, Volumen 1 de 2 Compatible con la 10a generación de la familia de procesadores Intel® Core™, procesadores Intel® Pentium®, procesadores Intel® Celeron® para plataformas U/Y, anteriormente conocidos como Ice Lake. Agosto de 2019 Revisión 001 Número del Documento: 341077-001 Líneas legales y descargos de responsabilidad Esta información es una combinación de una traducción hecha por humanos y de la traducción automática por computadora del contenido original para su conveniencia. Este contenido se ofrece únicamente como información general y no debe ser considerada como completa o precisa. No puede utilizar ni facilitar el uso de este documento en relación con ninguna infracción u otro análisis legal relacionado con los productos Intel descritos en este documento. Usted acepta conceder a Intel una licencia no exclusiva y libre de regalías a cualquier reclamación de patente redactada posteriormente que incluya el objeto divulgado en este documento. Este documento no concede ninguna licencia (expresa o implícita, por impedimento o de otro tipo) a ningún derecho de propiedad intelectual. Las características y beneficios de las tecnologías Intel dependen de la configuración del sistema y pueden requerir la activación de hardware, software o servicio habilitado. El desempeño varía según la configuración del sistema. Ningún equipo puede ser absolutamente seguro. Consulte al fabricante de su sistema o su distribuidor minorista u obtenga más información en intel.la. Las tecnologías Intel pueden requerir la activación de hardware habilitado, software específico o servicios. Consulte con el fabricante o distribuidor del sistema. Los productos descritos pueden contener defectos de diseño o errores conocidos como erratas que pueden hacer que el producto se desvíe de las especificaciones publicadas.
    [Show full text]
  • GPU Developments 2018
    GPU Developments 2018 2018 GPU Developments 2018 © Copyright Jon Peddie Research 2019. All rights reserved. Reproduction in whole or in part is prohibited without written permission from Jon Peddie Research. This report is the property of Jon Peddie Research (JPR) and made available to a restricted number of clients only upon these terms and conditions. Agreement not to copy or disclose. This report and all future reports or other materials provided by JPR pursuant to this subscription (collectively, “Reports”) are protected by: (i) federal copyright, pursuant to the Copyright Act of 1976; and (ii) the nondisclosure provisions set forth immediately following. License, exclusive use, and agreement not to disclose. Reports are the trade secret property exclusively of JPR and are made available to a restricted number of clients, for their exclusive use and only upon the following terms and conditions. JPR grants site-wide license to read and utilize the information in the Reports, exclusively to the initial subscriber to the Reports, its subsidiaries, divisions, and employees (collectively, “Subscriber”). The Reports shall, at all times, be treated by Subscriber as proprietary and confidential documents, for internal use only. Subscriber agrees that it will not reproduce for or share any of the material in the Reports (“Material”) with any entity or individual other than Subscriber (“Shared Third Party”) (collectively, “Share” or “Sharing”), without the advance written permission of JPR. Subscriber shall be liable for any breach of this agreement and shall be subject to cancellation of its subscription to Reports. Without limiting this liability, Subscriber shall be liable for any damages suffered by JPR as a result of any Sharing of any Material, without advance written permission of JPR.
    [Show full text]
  • EDN Magazine, December 17, 2004 (.Pdf)
    ᮋ HE BEST 100 PRODUCTS OF 2004 encompass a range of architectures and technologies Tand a plethora of categories—from analog ICs to multimedia to test-and-measurement tools. All are innovative, but, of the thousands that manufacturers announce each year and the hundreds that EDN reports on, only about 100 hot products make our readers re- ally sit up and take notice. Here are the picks from this year's crop. We present the basic info here. To get the whole scoop and find out why these products are so compelling, go to the Web version of this article on our Web site at www.edn.com. There, you'll find links to the full text of the articles that cover these products' dazzling features. ANALOG ICs Power Integrations COMMUNICATIONS NetLogic Microsystems Analog Devices LNK306P Atheros Communications NSE5512GLQ network AD1954 audio DAC switching power converter AR5005 Wi-Fi chip sets search engine www.analog.com www.powerint.com www.atheros.com www.netlogicmicro.com D2Audio Texas Instruments Fulcrum Microsystems Parama Networks XR125 seven-channel VCA8613 FM1010 six-port SPI-4,2 PNI8040 add-drop module eight-channel VGA switch chip multiplexer www.d2audio.com www.ti.com www.fulcrummicro.com www.paramanet.com International Rectifier Wolfson Microelectronics Motia PMC-Sierra IR2520D CFL ballast WM8740 audio DAC Javelin smart-antenna IC MSP2015, 2020, 4000, and power controller www.wolfsonmicro.com www.motia.com 5000 VoIP gateway chips www.irf.com www.pmc-sierra.com www.edn.com December 17, 2004 | edn 29 100 Texas Instruments Intel DISCRETE SEMICONDUCTORS
    [Show full text]
  • SIMD Extensions
    SIMD Extensions PDF generated using the open source mwlib toolkit. See http://code.pediapress.com/ for more information. PDF generated at: Sat, 12 May 2012 17:14:46 UTC Contents Articles SIMD 1 MMX (instruction set) 6 3DNow! 8 Streaming SIMD Extensions 12 SSE2 16 SSE3 18 SSSE3 20 SSE4 22 SSE5 26 Advanced Vector Extensions 28 CVT16 instruction set 31 XOP instruction set 31 References Article Sources and Contributors 33 Image Sources, Licenses and Contributors 34 Article Licenses License 35 SIMD 1 SIMD Single instruction Multiple instruction Single data SISD MISD Multiple data SIMD MIMD Single instruction, multiple data (SIMD), is a class of parallel computers in Flynn's taxonomy. It describes computers with multiple processing elements that perform the same operation on multiple data simultaneously. Thus, such machines exploit data level parallelism. History The first use of SIMD instructions was in vector supercomputers of the early 1970s such as the CDC Star-100 and the Texas Instruments ASC, which could operate on a vector of data with a single instruction. Vector processing was especially popularized by Cray in the 1970s and 1980s. Vector-processing architectures are now considered separate from SIMD machines, based on the fact that vector machines processed the vectors one word at a time through pipelined processors (though still based on a single instruction), whereas modern SIMD machines process all elements of the vector simultaneously.[1] The first era of modern SIMD machines was characterized by massively parallel processing-style supercomputers such as the Thinking Machines CM-1 and CM-2. These machines had many limited-functionality processors that would work in parallel.
    [Show full text]
  • Demystifying Internet of Things Security Successful Iot Device/Edge and Platform Security Deployment — Sunil Cheruvu Anil Kumar Ned Smith David M
    Demystifying Internet of Things Security Successful IoT Device/Edge and Platform Security Deployment — Sunil Cheruvu Anil Kumar Ned Smith David M. Wheeler Demystifying Internet of Things Security Successful IoT Device/Edge and Platform Security Deployment Sunil Cheruvu Anil Kumar Ned Smith David M. Wheeler Demystifying Internet of Things Security: Successful IoT Device/Edge and Platform Security Deployment Sunil Cheruvu Anil Kumar Chandler, AZ, USA Chandler, AZ, USA Ned Smith David M. Wheeler Beaverton, OR, USA Gilbert, AZ, USA ISBN-13 (pbk): 978-1-4842-2895-1 ISBN-13 (electronic): 978-1-4842-2896-8 https://doi.org/10.1007/978-1-4842-2896-8 Copyright © 2020 by The Editor(s) (if applicable) and The Author(s) This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Open Access This book is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this book are included in the book’s Creative Commons license, unless indicated otherwise in a credit line to the material.
    [Show full text]
  • Program Review Department of Computer Science
    PROGRAM REVIEW DEPARTMENT OF COMPUTER SCIENCE UNIVERSITY OF NORTH CAROLINA AT CHAPEL HILL JANUARY 13-15, 2009 TABLE OF CONTENTS 1 Introduction............................................................................................................................. 1 2 Program Overview.................................................................................................................. 2 2.1 Mission........................................................................................................................... 2 2.2 Demand.......................................................................................................................... 3 2.3 Interdisciplinary activities and outreach ........................................................................ 5 2.4 Inter-institutional perspective ........................................................................................ 6 2.5 Previous evaluations ...................................................................................................... 6 3 Curricula ................................................................................................................................. 8 3.1 Undergraduate Curriculum ............................................................................................ 8 3.1.1 Bachelor of Science ................................................................................................. 10 3.1.2 Bachelor of Arts (proposed) ...................................................................................
    [Show full text]
  • FAST HASHING in CUDA Neville Walo Department of Computer
    FAST HASHING IN CUDA Neville Walo Department of Computer Science ETH Zurich¨ Zurich,¨ Switzerland ABSTRACT cies, it is possible to use the compression function of SHA- Hash functions, such as SHA-256 [1], are extensively used 256 along with the Sarkar-Schellenberg composition prin- in cryptographic applications. However, SHA-256 cannot ciple [2] to create a parallel collision resistant hash function be parallelized due to sequential dependencies. Using the called PARSHA-256 [3]. Sarkar-Schellenberg composition principle [2] in combina- In this work, we try to accelerate hashing in CUDA [6]. tion with SHA-256 gives rise to PARSHA-256 [3], a parallel We have divided this project into two sub-projects. The first collision resistant hash function. We present efficient imple- one is the Bitcoin scenario, with the goal to calculate many mentations for both SHA-256 and PARSHA-256 in CUDA. independent SHA-256 computation in parallel. The second Our results demonstrate that for large messages PARSHA- case is PARSHA-256, where the goal is to implement the 256 can significantly outperform SHA-256. proposed algorithm efficiently in CUDA. Related work. To our knowledge there is no compara- ble implementation of PARSHA-256 which runs on a GPU. 1. INTRODUCTION There exists only the implementation of the original paper, Hash functions are one of the most important operations which uses multithreading [3]. On the other hand, there in cryptographic applications, like digital signature algo- are countless implementations of Bitcoin Miners in CUDA rithms, keyed-hash message authentication codes, encryp- [7, 8], as this was the most prominent way to mine Bitcoins tions and the generation of random numbers.
    [Show full text]
  • Linux Hardware Compatibility HOWTO
    Linux Hardware Compatibility HOWTO Steven Pritchard Southern Illinois Linux Users Group [email protected] 3.1.5 Copyright © 2001−2002 by Steven Pritchard Copyright © 1997−1999 by Patrick Reijnen 2002−03−28 This document attempts to list most of the hardware known to be either supported or unsupported under Linux. Linux Hardware Compatibility HOWTO Table of Contents 1. Introduction.....................................................................................................................................................1 1.1. Notes on binary−only drivers...........................................................................................................1 1.2. Notes on commercial drivers............................................................................................................1 1.3. System architectures.........................................................................................................................1 1.4. Related sources of information.........................................................................................................2 1.5. Known problems with this document...............................................................................................2 1.6. New versions of this document.........................................................................................................2 1.7. Feedback and corrections..................................................................................................................3 1.8. Acknowledgments.............................................................................................................................3
    [Show full text]
  • The Opengl ES Shading Language
    The OpenGL ES® Shading Language Language Version: 3.00 Document Revision: 6 29 January 2016 Editor: Robert J. Simpson, Qualcomm OpenGL GLSL editor: John Kessenich, LunarG GLSL version 1.1 Authors: John Kessenich, Dave Baldwin, Randi Rost Copyright © 2008-2016 The Khronos Group Inc. All Rights Reserved. This specification is protected by copyright laws and contains material proprietary to the Khronos Group, Inc. It or any components may not be reproduced, republished, distributed, transmitted, displayed, broadcast, or otherwise exploited in any manner without the express prior written permission of Khronos Group. You may use this specification for implementing the functionality therein, without altering or removing any trademark, copyright or other notice from the specification, but the receipt or possession of this specification does not convey any rights to reproduce, disclose, or distribute its contents, or to manufacture, use, or sell anything that it may describe, in whole or in part. Khronos Group grants express permission to any current Promoter, Contributor or Adopter member of Khronos to copy and redistribute UNMODIFIED versions of this specification in any fashion, provided that NO CHARGE is made for the specification and the latest available update of the specification for any version of the API is used whenever possible. Such distributed specification may be reformatted AS LONG AS the contents of the specification are not changed in any way. The specification may be incorporated into a product that is sold as long as such product includes significant independent work developed by the seller. A link to the current version of this specification on the Khronos Group website should be included whenever possible with specification distributions.
    [Show full text]
  • A Fast, Verified, Cross-Platform Cryptographic Provider
    EverCrypt: A Fast, Verified, Cross-Platform Cryptographic Provider Jonathan Protzenko∗, Bryan Parnoz, Aymeric Fromherzz, Chris Hawblitzel∗, Marina Polubelovay, Karthikeyan Bhargavany Benjamin Beurdouchey, Joonwon Choi∗x, Antoine Delignat-Lavaud∗,Cedric´ Fournet∗, Natalia Kulatovay, Tahina Ramananandro∗, Aseem Rastogi∗, Nikhil Swamy∗, Christoph M. Wintersteiger∗, Santiago Zanella-Beguelin∗ ∗Microsoft Research zCarnegie Mellon University yInria xMIT Abstract—We present EverCrypt: a comprehensive collection prone (due in part to Intel and AMD reporting CPU features of verified, high-performance cryptographic functionalities avail- inconsistently [78]), with various cryptographic providers able via a carefully designed API. The API provably supports invoking illegal instructions on specific platforms [74], leading agility (choosing between multiple algorithms for the same functionality) and multiplexing (choosing between multiple im- to killed processes and even crashing kernels. plementations of the same algorithm). Through abstraction and Since a cryptographic provider is the linchpin of most zero-cost generic programming, we show how agility can simplify security-sensitive applications, its correctness and security are verification without sacrificing performance, and we demonstrate crucial. However, for most applications (e.g., TLS, cryptocur- how C and assembly can be composed and verified against rencies, or disk encryption), the provider is also on the critical shared specifications. We substantiate the effectiveness of these techniques with
    [Show full text]
  • Semiconductor Industry Merger and Acquisition Activity from an Intellectual Property and Technology Maturity Perspective
    Semiconductor Industry Merger and Acquisition Activity from an Intellectual Property and Technology Maturity Perspective by James T. Pennington B.S. Mechanical Engineering (2011) University of Pittsburgh Submitted to the System Design and Management Program in Partial Fulfillment of the Requirements for the Degree of Master of Science in Engineering and Management at the Massachusetts Institute of Technology September 2020 © 2020 James T. Pennington All rights reserved The author hereby grants to MIT permission to reproduce and to distribute publicly paper and electronic copies of this thesis document in whole or in part in any medium now known or hereafter created. Signature of Author ____________________________________________________________________ System Design and Management Program August 7, 2020 Certified by __________________________________________________________________________ Bruce G. Cameron Thesis Supervisor System Architecture Group Director in System Design and Management Accepted by __________________________________________________________________________ Joan Rubin Executive Director, System Design & Management Program THIS PAGE INTENTIALLY LEFT BLANK 2 Semiconductor Industry Merger and Acquisition Activity from an Intellectual Property and Technology Maturity Perspective by James T. Pennington Submitted to the System Design and Management Program on August 7, 2020 in Partial Fulfillment of the Requirements for the Degree of Master of Science in System Design and Management ABSTRACT A major method of acquiring the rights to technology is through the procurement of intellectual property (IP), which allow companies to both extend their technological advantage while denying it to others. Public databases such as the United States Patent and Trademark Office (USPTO) track this exchange of technology rights. Thus, IP can be used as a public measure of value accumulation in the form of technology rights.
    [Show full text]