GridinSoft Threat Intelligence

atikmdag.sys threat report

Detected as Trojan.Generic File reputation report
MD5 f35cc07ef4ec22014cdec45b4451a22b
Latest seen 2023-10-13 23:02:42 (2 years ago)
First seen 2023-07-02 23:04:39 (2 years ago)
Size 19 MB
Publisher Advanced Micro Devices, Inc.
Product ATI Radeon Family

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2023-10-13 23:02:42 (2 years ago)
File hash
f35cc07ef4ec22014cdec45b4451a22b
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic.

Timeline

First seen 2023-07-02 23:04:39 (2 years ago); latest analysis 2023-10-13 23:02:42 (2 years ago).

Publisher context

Company metadata: Advanced Micro Devices, Inc.. Product metadata: ATI Radeon Family.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

File context

atikmdag.sys is a Windows file recorded in the ThreatInfo database. It is associated with ATI Radeon Family. The reported company name is Advanced Micro Devices, Inc.. The current detection status is Trojan.Generic, based on the latest analysis from 2023-10-13 23:02:42 (2 years ago).

If atikmdag.sys appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

File Details

Product Name: ATI Radeon Family
Company Name: Advanced Micro Devices, Inc.
MD5: f35cc07ef4ec22014cdec45b4451a22b
Size: 19 MB
First Published: 2023-07-02 23:04:39 (2 years ago)
Latest Published: 2023-10-13 23:02:42 (2 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2023-10-13 23:02:42 (2 years ago)

Detection screenshot

atikmdag.sys detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Common Places:

%sysdrive%\sm850\windows.old.000\windows\system32\driverstore\filerepository\c7183844.inf_amd64_neutral_83df91b9c4e896c5
%sysdrive%\windows.old.000\windows\system32\driverstore\filerepository\c7183844.inf_amd64_neutral_83df91b9c4e896c5
%sysdrive%\sm850\windows.old\windows\system32\driverstore\filerepository\c7183844.inf_amd64_neutral_83df91b9c4e896c5
%sysdrive%\windows.old.000\windows\system32
%system%\driverstore\filerepository\c7183844.inf_amd64_neutral_83df91b9c4e896c5
%sysdrive%\windows.old\windows\system32\driverstore\filerepository\c7183844.inf_amd64_neutral_83df91b9c4e896c5
%sysdrive%\sm850\windows.old.000\windows\system32
%sysdrive%\desktop\windows\system32\driverstore\filerepository\c7183844.inf_amd64_neutral_83df91b9c4e896c5

ThreatInfo has observed atikmdag.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen atikmdag.sys across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country United States
Share 100.0%
Low High activity

The strongest geographic signal for this file is United States with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 100.0%

The most common operating system signal for atikmdag.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

atikmdag.sys is identified as pe for 64-bit systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 64-bit
Subsystem Native
Entry point 0x00002070
Image base 0x0000000000010000

PE Sections:

Sections 55
Raw data 20926976

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 4046848 bytes · 19.3% of section data
MD5 07d6516fa6e37bd2f1fb82151909957d
_wtext 512 bytes · 0.0% of section data
Uncommon name
MD5 4a17a765c2138ca1e21da1c2a7e4cf50
.rdata 1647616 bytes · 7.9% of section data
MD5 e8d7a2a9625cab8c3194156d33ae2521
.data 6358016 bytes · 30.4% of section data
Large raw data
MD5 90ed3a1cf0fb4b03f372b2402c63ca23
.pdata 337920 bytes · 1.6% of section data
MD5 527dd419efcea3221b9dfad65f3f49bb
.gfids 512 bytes · 0.0% of section data
Uncommon name
MD5 35d518de1d79f86844e630d6d1523f3d
PAGE_COM 487424 bytes · 2.3% of section data
Uncommon name
MD5 4e572f8ecd9b60add8adaaf201e3f049
PAGE 8192 bytes · 0.0% of section data
Uncommon name
MD5 00270293d76ccbb2903b0a4c7d6f4584
PAGE_CAI 274432 bytes · 1.3% of section data
Uncommon name
MD5 3ea55bb21b683f929fa7c8a5320e332f
PAGE_DAL 15872 bytes · 0.1% of section data
Uncommon name
MD5 633f2cbe3f1275894fa5ad63ef8edbc7
PAGE_ISR 17408 bytes · 0.1% of section data
Uncommon name
MD5 05bd2f3ab70f7e8fe64c6993cef33dd4
PAGEDC40 1024 bytes · 0.0% of section data
Uncommon name
MD5 7ae3255c6989d1297cf745722bb3d15f
PAGEDC50 1024 bytes · 0.0% of section data
Uncommon name
MD5 aa03086e1fcf12bd2a457ba7d97e1100
PAGEDC60 1536 bytes · 0.0% of section data
Uncommon name
MD5 f22d8f766d44fcfe3f12f4dd5b9cf022
PAGEDC80 22016 bytes · 0.1% of section data
Uncommon name
MD5 a7202368f7b7120450a4f824d5542920
PAGEDC10 10240 bytes · 0.0% of section data
Uncommon name
MD5 b1c8bd553c4296309ebca3624cd2def8
PAGEDC11 46592 bytes · 0.2% of section data
Uncommon name
MD5 84f44ccdc6357c6fdee49e606a5a48fd
PAGEDC11 25600 bytes · 0.1% of section data
Uncommon name
MD5 298dd61a1a82b75f537964b7d6fd0b90
PAGE_PPL 776704 bytes · 3.7% of section data
Uncommon name
MD5 286de0c3216518d96041bc9a08b387d1
PAGE_CPC 159744 bytes · 0.8% of section data
Uncommon name
MD5 95be5059e7d144fc5057cbbc5ba597a8
PAGE_CAI 1970176 bytes · 9.4% of section data
Uncommon name
MD5 32d65f1b53141bfa89c455aeea2c52de
PAGE 3306496 bytes · 15.8% of section data
Uncommon name
MD5 21f071463d6d8fb00aab633de3fbf91e
PAGE_IEG 34816 bytes · 0.2% of section data
Uncommon name
MD5 3e7a588db225750f809420cad0d246e9
PAGE_ILN 18432 bytes · 0.1% of section data
Uncommon name
MD5 17a460c1f0862a1c6343210a4e5cb204
PAGE_IBT 31744 bytes · 0.2% of section data
Uncommon name
MD5 2a86e558b22c9a54ef85e01eb3f08e72
PAGE_INI 34304 bytes · 0.2% of section data
Uncommon name
MD5 f25e0914097e52cdcac44339d06c8ffe
PAGE_ITN 24576 bytes · 0.1% of section data
Uncommon name
MD5 6d86b43e1c6dbd29f232434e42c014f5
PAGE_ISI 34304 bytes · 0.2% of section data
Uncommon name
MD5 0c822e73f50504d99fb06ddbf6ba10a2
PAGE_ICI 38400 bytes · 0.2% of section data
Uncommon name
MD5 512d361821b429079b072598f179dcba
PAGE_IKV 35840 bytes · 0.2% of section data
Uncommon name
MD5 96f6cd425f1694be4d2faa3f47f4607e
PAGE_IIL 16896 bytes · 0.1% of section data
Uncommon name
MD5 821c7b046e303118e94217afe5b277db
PAGE_IVI 41984 bytes · 0.2% of section data
Uncommon name
MD5 0b63b350295d0f818b63b0c00caa385b
PAGE_ICZ 40448 bytes · 0.2% of section data
Uncommon name
MD5 9c02761a46db5d23f0d4fea223b70374
PAGE_ISR 8192 bytes · 0.0% of section data
Uncommon name
MD5 92dd4fbe26970a3a23ede8b7df082068
PAGE_RO 8192 bytes · 0.0% of section data
Uncommon name
MD5 04d472a5f4fec969e7891268e6421b27
PAGE_ISR 512 bytes · 0.0% of section data
Uncommon name
MD5 293e1b191310cee3f31060ce0ee79014
PAGE_RW 680960 bytes · 3.3% of section data
Uncommon name
MD5 2a95c7c5c3a20288d17cc95e970d6c36
PAGEDC50 512 bytes · 0.0% of section data
Uncommon name
MD5 4dc68c7ed7f5ede0956a9cf0012949b8
PAGEDC60 512 bytes · 0.0% of section data
Uncommon name
MD5 bb8222a8fa11efc3f69ba75b5d74f679
PAGEDC11 8192 bytes · 0.0% of section data
Uncommon name
MD5 c0e7a818d35dc7b647f76e4f7be48f80
PAGEDC80 1536 bytes · 0.0% of section data
Uncommon name
MD5 eae5d83fcb372538c587eb700f3b457b
PAGEDC10 512 bytes · 0.0% of section data
Uncommon name
MD5 f4aea67688b698c1c7e76bd03cf79c81
PAGEDC11 1024 bytes · 0.0% of section data
Uncommon name
MD5 222611777ae92221712f46b66243d356
PAGEDC40 512 bytes · 0.0% of section data
Uncommon name
MD5 146f5be0709dc3eed343a52436030517
PAGEDC40 512 bytes · 0.0% of section data
Uncommon name
MD5 8ff763cf05ba4365d077723c056d66b0
PAGEDC50 512 bytes · 0.0% of section data
Uncommon name
MD5 13093414f8da7c21e14a4fe79b8b599c
PAGEDC60 512 bytes · 0.0% of section data
Uncommon name
MD5 690a24b7162f0033be67625051f24f5f
PAGEDC80 512 bytes · 0.0% of section data
Uncommon name
MD5 30f225d035e92559642f72689be434f9
PAGEDC10 512 bytes · 0.0% of section data
Uncommon name
MD5 46bc18cd96c556167a8211adf011cab3
PAGEDC11 512 bytes · 0.0% of section data
Uncommon name
MD5 856408247d6aa44356674a84ea672082
PAGEDC11 512 bytes · 0.0% of section data
Uncommon name
MD5 68a929bf12852d444c805d52e25f8e2c
PAGE_CPR 32768 bytes · 0.2% of section data
Uncommon name
MD5 981392e47a59c9b18e630c9fe4a1344a
INIT 6656 bytes · 0.0% of section data
Uncommon name
MD5 37b4eac56f16bc420598e870c68ce7cb
.rsrc 2560 bytes · 0.0% of section data
MD5 0a218b9fdf8db165c76cc33fbec925c6
.reloc 303104 bytes · 1.4% of section data
MD5 a044f9c4f5bc4e5e842eb092e446cb93

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Trojan.Generic

This report identifies atikmdag.sys by MD5 f35cc07ef4ec22014cdec45b4451a22b. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with f35cc07ef4ec22014cdec45b4451a22b.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found.