Online Scan: Analyze intel_opencl_icd32.dll file and fix runtime errors, Fix System Error
Welcome to my blog. I found a malicious code that was added into the intel_opencl_icd32.dll file. Due to infection by malicious code, the file contents changed. The MD5 value of the infected file is: 058180789788744b214403b42b027e08, and the file size is:
300 K ( 307,206 bytes )
Risk level of malicious code
( 3 stars by 23 users )
Behavior of malicious code ( 31 votes ) If you know more this malicious code, please vote. We sincerely hope you may share your information with other computer users and help them.
1. Infect file
16.13% (5)
2. Intentionally destroy data16.13% (5)
3. Steal personal privacy9.68% (3)
4. Infect other computers through the Internet16.13% (5)
5. Install the backdoor program so that the computer is controlled remotely3.23% (1)
6. Cheat or threaten users to buy something12.9% (4)
7. Download and install other programs without permission in the background12.9% (4)
8. Pop up various advertisements and induce users to click12.9% (4)
Binary Code Analysis:
When the program runs, the PE loader will try to load the file to 0x10000000 in the virtual address space, Address Of Entry Point: 0x00003EF0. This file has 6 SECTION.
DOS Header
DOS Stub
...
...
NT File Signature
NT HEADER
FILE HEADER
OPTIONAL HEADER
Data Directory
.text SECTION #1
.rdata SECTION #2
.data SECTION #3
.rsrc SECTION #4
.reloc SECTION #5
.text SECTION #6
- Name
- Virtual Size
- Virtual Address
- Size Of Raw Data
- Pointer To Raw Data
- Pointer To Relocations
- Pointer To Linenumbers
- Number Of Relocations
- Number Of Linenumbers
- Characteristics
- SECTION #1
- .text
- 0x0000CDC6
- 0x00001000
- 0x0000CE00
- 0x00000400
- 0x00000000
- 0x00000000
- 0x00000000
- 0x00000000
- 0x60000020
- SECTION #2
- .rdata
- 0x00005868
- 0x0000E000
- 0x00005A00
- 0x0000D200
- 0x00000000
- 0x00000000
- 0x00000000
- 0x00000000
- 0x40000040
- SECTION #3
- .data
- 0x00002F40
- 0x00014000
- 0x00001200
- 0x00012C00
- 0x00000000
- 0x00000000
- 0x00000000
- 0x00000000
- 0xC0000040
- SECTION #4
- .rsrc
- 0x00000320
- 0x00017000
- 0x00000400
- 0x00013E00
- 0x00000000
- 0x00000000
- 0x00000000
- 0x00000000
- 0x40000040
- SECTION #5
- .reloc
- 0x00000E20
- 0x00018000
- 0x00001000
- 0x00014200
- 0x00000000
- 0x00000000
- 0x00000000
- 0x00000000
- 0x42000040
- Name
- Virtual Size
- Virtual Address
- Size Of Raw Data
- Pointer To Raw Data
- Pointer To Relocations
- Pointer To Linenumbers
- Number Of Relocations
- Number Of Linenumbers
- Characteristics
- SECTION #6
- .text
- 0x0001B000
- 0x00019000
- 0x0001AE00
- 0x00015200
- 0x00000000
- 0x00000000
- 0x00000000
- 0x00000000
- 0xE0000020
About this malicious code
This malicious code is a 32-bit program that infects an DLL file. When the file is run or the file is loaded, the malicious code in the file is run first. Later, this malicious code also infects the following files:
Tip: There is something I must emphasize. The file names listed above are infected by malicious code. It does not mean that all files named by these names are malicious files. It is inaccurate to determine whether a file is a malicious program based on its file name.
The malicious code also infects files on the following path:
• c:\windows\boot\resources\de-de\• c:\windows\system32\drivers\zh-cn\
• c:\windows\system32\e177e04d548c4006a465eeb92d3de021\runtime\objects\
• c:\windows\softwaredistribution.bck\download\dd9ae82a22379d79f28dbbbd0b0f5df4\x86_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.3.9600.18295_none_e22dff809a45cf47\
• c:\windows\configsetroot\software\ai_suiteiii\usb 3 boost - v1.10.00\appsetup\uasdriver\i386\
• c:\windows\updatepack7live\kb3042058\x86_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7601.18812_hu-hu_45fe4f5f8f793563\
• c:\windows\eole\
• c:\windows\resources\themes\blade\shell\normalcolor\
• c:\windows\temp\7zs0dc39572\system64\drivers\2003\
• c:\windows\panther\rollback\efi\microsoft\boot\resources\nb-no\
• c:\windows\system32\nladm\bin\imageformats\
Tip: The code of most malicious files is fixed, rarely changed, which means, this type of malicious files regardless of which computer they are in, will copy themselves into the pre-set path, so we can go to the path listed above to find this file, and there is a great chance to find it.
Are all the files with the same file name listed above and with the same path malicious files?
Of course not. The file name is just the identification of the file. Strictly speaking, the file is modified by malicious code.
The following are methods commonly used by malicious code in order to confuse users:
• Deliberately modify their own file name to some system file name, or some well-known software name.
• Generate malicious files in the system folder or in the installation folder of some well-known software, and even name their own folder with an antivirus software name (actually the user did not install this antivirus software). In fact, these malicious files are not system files, nor part of the famous software.
For example, one of the most common system file names is: explorer.exe, and under normal circumstances, the system only has an explorer.exe process. When you open the Task Manager and find that there are two or more explorer.exe processes, it is likely the camouflage of some malicious viruses. As shown in the following figure, there are two explorer.exe processes in Task Manager.
When I find the path where the file is located, it will be clear that the real explorer.exe system file is located under "C:\ Windows\", and the malicious file that pretends to be system process is under the other path.
At runtime, 2 Windows system files, 0 external files (not owned by the Windows system), are called
Windows system files
File name Number of calling functions
KERNEL32.dll 62 ADVAPI32.dll 3
Not owned by the windows system
File name Number of calling functions
In general, the most accurate way to determine if a file is a malicious file is to analyze its code and see what happens when these functions are called while the program is running. Does it have malicious behavior (destroying data or stealing data)? I have listed the functions called by this file and some internal data, but there is too much data, I can't show them all here. →Click here← to see the full binary code analysis page.
Export function:
The following function is a function provided by this file. The export function is useful for analyzing the specific behavior of a runtime file, starting from the function entry address, and debugging the code line by line. You can get a lot of data generated by this file.Export File - OpenCL.dllOrdinals Function Name Entry Address 0x00000001 clBuildProgram 0x00000BF0 0x00000002 clCompileProgram 0x00000C10 0x00000003 clCreateBuffer 0x00000960 0x00000004 clCreateCommandQueue 0x000008C0 0x00000005 clCreateCommandQueueWithProperties 0x00002CF0 0x00000006 clCreateContext 0x00000770 0x00000007 clCreateContextFromType 0x000007E0 0x00000008 clCreateFromGLBuffer 0x00002630 0x00000009 clCreateFromGLRenderbuffer 0x00002730 0x0000000C clCreateFromGLTexture 0x00002670 0x0000000A clCreateFromGLTexture2D 0x000026B0 0x0000000B clCreateFromGLTexture3D 0x000026F0 0x0000000F clCreateImage 0x000009A0 0x0000000D clCreateImage2D 0x00001BB0 0x0000000E clCreateImage3D 0x00001C00 0x00000010 clCreateKernel 0x00000CE0 0x00000011 clCreateKernelsInProgram 0x00000D10 0x00000012 clCreatePipe 0x00002D20 0x00000013 clCreateProgramWithBinary 0x00000B50 0x00000014 clCreateProgramWithBuiltInKernels 0x00000B80 0x00000015 clCreateProgramWithSource 0x00000B20 0x00000016 clCreateSampler 0x00000A90 0x00000017 clCreateSamplerWithProperties 0x00002EA0 0x00000018 clCreateSubBuffer 0x00002B90 0x00000019 clCreateSubDevices 0x00000710 0x0000001A clCreateUserEvent 0x00002BF0 0x0000001B clEnqueueAcquireGLObjects 0x000027B0 0x0000001C clEnqueueBarrier 0x00001CA0 0x0000001D clEnqueueBarrierWithWaitList 0x00001210 0x0000001E clEnqueueCopyBuffer 0x00000F90 0x0000001F clEnqueueCopyBufferRect 0x00000FB0 0x00000020 clEnqueueCopyBufferToImage 0x00001070 0x00000021 clEnqueueCopyImage 0x00001030 0x00000022 clEnqueueCopyImageToBuffer 0x00001050 0x00000023 clEnqueueFillBuffer 0x00000F70 0x00000024 clEnqueueFillImage 0x00001010 0x00000025 clEnqueueMapBuffer 0x00001090 0x00000026 clEnqueueMapImage 0x000010E0 0x00000027 clEnqueueMarker 0x00001C60 0x00000028 clEnqueueMarkerWithWaitList 0x000011F0 0x00000029 clEnqueueMigrateMemObjects 0x00001150 0x0000002A clEnqueueNDRangeKernel 0x00001190 0x0000002B clEnqueueNativeKernel 0x000011D0 0x0000002C clEnqueueReadBuffer 0x00000EF0 0x0000002D clEnqueueReadBufferRect 0x00000F10 0x0000002E clEnqueueReadImage 0x00000FD0 0x0000002F clEnqueueReleaseGLObjects 0x000027D0 0x00000030 clEnqueueSVMFree 0x00002DE0 0x00000031 clEnqueueSVMMap 0x00002E40 0x00000032 clEnqueueSVMMemFill 0x00002E20 0x00000033 clEnqueueSVMMemcpy 0x00002E00 0x00000034 clEnqueueSVMUnmap 0x00002E80 0x00000035 clEnqueueTask 0x000011B0 0x00000036 clEnqueueUnmapMemObject 0x00001130 0x00000037 clEnqueueWaitForEvents 0x00001C80 0x00000038 clEnqueueWriteBuffer 0x00000F30 0x00000039 clEnqueueWriteBufferRect 0x00000F50 0x0000003A clEnqueueWriteImage 0x00000FF0 0x0000003B clFinish 0x00000ED0 0x0000003C clFlush 0x00000EB0 0x0000003D clGetCommandQueueInfo 0x00000940 0x0000003E clGetContextInfo 0x000008A0 0x0000003F clGetDeviceIDs 0x000006A0 0x00000040 clGetDeviceInfo 0x000006F0 0x00000041 clGetEventInfo 0x00000E30 0x00000042 clGetEventProfilingInfo 0x00000E90 0x00000043 clGetExtensionFunctionAddress 0x00001CC0 0x00000044 clGetExtensionFunctionAddressForPlatform 0x00001230 0x00000045 clGetGLObjectInfo 0x00002770 0x00000046 clGetGLTextureInfo 0x00002790 0x00000047 clGetImageInfo 0x00000A70 0x00000048 clGetKernelArgInfo 0x00000DB0 0x00000049 clGetKernelInfo 0x00000D90 0x0000004A clGetKernelWorkGroupInfo 0x00000DD0 0x0000004B clGetMemObjectInfo 0x00000A50 0x0000004C clGetPipeInfo 0x00002D60 0x0000004D clGetPlatformIDs 0x000005B0 0x0000004E clGetPlatformInfo 0x00000660 0x0000004F clGetProgramBuildInfo 0x00000CC0 0x00000050 clGetProgramInfo 0x00000CA0 0x00000051 clGetSamplerInfo 0x00000B00 0x00000052 clGetSupportedImageFormats 0x00000A20 0x00000053 clLinkProgram 0x00000C30 0x00000054 clReleaseCommandQueue 0x00000920 0x00000055 clReleaseContext 0x00000880 0x00000056 clReleaseDevice 0x00000750 0x00000057 clReleaseEvent 0x00000E70 0x00000058 clReleaseKernel 0x00000D50 0x00000059 clReleaseMemObject 0x00000A00 0x0000005A clReleaseProgram 0x00000BD0 0x0000005B clReleaseSampler 0x00000AE0 0x0000005C clRetainCommandQueue 0x00000900 0x0000005D clRetainContext 0x00000860 0x0000005E clRetainDevice 0x00000730 0x0000005F clRetainEvent 0x00000E50 0x00000060 clRetainKernel 0x00000D30 0x00000061 clRetainMemObject 0x000009E0 0x00000062 clRetainProgram 0x00000BB0 0x00000063 clRetainSampler 0x00000AC0 0x00000064 clSVMAlloc 0x00002D80 0x00000065 clSVMFree 0x00002DB0 0x00000066 clSetCommandQueueProperty 0x00001B20 0x00000067 clSetEventCallback 0x00002B70 0x00000068 clSetKernelArg 0x00000D70 0x00000069 clSetKernelArgSVMPointer 0x00002ED0 0x0000006A clSetKernelExecInfo 0x00002EF0 0x0000006B clSetMemObjectDestructorCallback 0x00002BD0 0x0000006C clSetUserEventStatus 0x00002C20 0x0000006D clUnloadCompiler 0x00001C50 0x0000006E clUnloadPlatformCompiler 0x00000C60 0x0000006F clWaitForEvents 0x00000DF0
intel_opencl_icd32.dll runtime behavior analysis
The KERNEL32.dll dynamic link library is loaded and the functions in the file are called: ( Kernel32.dll is a very important 32-bit dynamic link library file in the Windows operating system. It is a kernel-level file. It controls the system's memory management, data input and output operations and interrupt handling. When the Windows operating system starts, kernel32.dll resides in a specific write-protected area of memory, so that other programs cannot occupy this memory area. )
The ADVAPI32.dll dynamic link library is loaded and the functions in the file are called: ( Advapi32.dll is part of a high-level API application interface service library that contains functions related to object security, registry manipulation, and event logging. It is generally located in the system directory: \WINDOWS\system32\ )
The following files have been identified as malicious files. Some files are variants of intel_opencl_icd32.dll; some files are another type of malicious file, but use the same file name as intel_opencl_icd32.dll.
It is a simple and effective way to determine whether a file is a malicious file by a hash value, which has lower false detection rate than the "static signature" method. So, if the MD5 value of a file on the computer is the same as the MD5 value listed below, then it is sure that the file is a malicious file.
This is my analysis results to the code of each malicious below, mainly provided to industry professionals who engage in the maintenance of computer security. If you are interested, you can also have a view, but it may require certain computer knowledge.- File Md5
- File Size
- File Bit
- File Type
- Binary Code Analysis
- 058180789788744b214403b42b027e08
- 300 K
- 32 bit
- DLL
- → View Binary Code
How to repair or remove intel_opencl_icd32.dll
Method 1: Manual Removal
• Reboot the system and then enter safe mode (Click here to see how each Windows version (XP/Vista/7/8/10) goes into safe mode)
• Show all hidden files.
Step: "My Computer" -> "Floder Options" ->"View" -> "Show hidden files, folders, and drives"
• Malicious code used to generate or infect files on the following paths, so you need to one by one go into the following path, and delete all files [ intel_opencl_icd32.dll ]
• c:\windows\boot\resources\de-de\
• c:\windows\system32\drivers\zh-cn\
• c:\windows\system32\e177e04d548c4006a465eeb92d3de021\runtime\objects\
• c:\windows\softwaredistribution.bck\download\dd9ae82a22379d79f28dbbbd0b0f5df4\x86_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.3.9600.18295_none_e22dff809a45cf47\
• c:\windows\configsetroot\software\ai_suiteiii\usb 3 boost - v1.10.00\appsetup\uasdriver\i386\
• c:\windows\updatepack7live\kb3042058\x86_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7601.18812_hu-hu_45fe4f5f8f793563\
• c:\windows\system32\drivers\zh-cn\
• c:\windows\system32\e177e04d548c4006a465eeb92d3de021\runtime\objects\
• c:\windows\softwaredistribution.bck\download\dd9ae82a22379d79f28dbbbd0b0f5df4\x86_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.3.9600.18295_none_e22dff809a45cf47\
• c:\windows\configsetroot\software\ai_suiteiii\usb 3 boost - v1.10.00\appsetup\uasdriver\i386\
• c:\windows\updatepack7live\kb3042058\x86_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7601.18812_hu-hu_45fe4f5f8f793563\
• Finally, restart your computer.
Method 2: Automatic Removal Using Tools (Recommended)
This is free virus detection software, and it can be well compatible with many well-known anti-virus software, so users do not have to uninstall anti-virus software on the computer.
It is "environmentally friendly" for computers. After downloading, it can be used by decompression and without installation. In the process of running, it will not write any information to the registry, nor create any new files to the Windows folder of the system disk. When you do not need it, you can delete it. It will not leave any spam information on your computer.
When you find your operating system is abnormal, and the file name listed above appears in the Task Manager, or there are several processes in running with the same name as the core file name, it is best to download the anti-virus software to check your system.
Online detection of intel_opencl_icd32.dll
If you don't know if intel_opencl_icd32.dll is infected with malicious code on your computer, you may also use online scan tool.
• Use the following online detection function to check the file.
How do I use the T21 engine for online scanning?
T21 can detect unknown files online, mainly using "behavior-based" judgment mechanism. It is very simple to use T21.
1. Click the "Upload File" button, select the file you want to detect, and then click "Submit".2. The next step is to wait for the system to check, which may take a little time, so please be patient.
3. When the T21 scan engine finishes detection, the test results are immediately fed back, as shown below:
Other captured malicious files:
mcu.exe file analysis
dopdfin7.exe file analysis
dopdf.exe file analysis
ocl_cpu_intelopencl32.dll file analysis
winmon.sys#a4ceebe921574ac8 file analysis
winmonprocessmonitor.sys#50b8293a3f329df3 file analysis
patch.exe.112978.gzquar file analysis
qtsolutions_service-head.dll file analysis
foxitconnectedpdfservice.exe file analysis
Copyright statement: The above data is obtained by my analysis, and without authorization, you may not copy or reprint it.
Leave a Reply
Your email address will not be published. Required fields are marked *
Your email address will not be published. Required fields are marked *
If you need help, please leave a message, try to match the picture, and I will reply as soon as possible to each question.
Copyright © 2016-2019 mygoodtools.com All rights reserved.