Static task
static1
Behavioral task
behavioral1
Sample
Dx11 ImGui - Black Ops lll.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Dx11 ImGui - Black Ops lll.dll
Resource
win10v2004-20230220-en
General
-
Target
Dx11 ImGui - Black Ops lll.dll.exe
-
Size
1.7MB
-
MD5
bb1fc79b1476b615cadf4c04bd805014
-
SHA1
7039a8d563a0514a4284416e5c670916e5ce51c7
-
SHA256
a058c03a6dceb242a9c97b094afb4941c9f5e9c463f773641cf882612eb9ceff
-
SHA512
f417b518ab33683e2f66cb1aea1e42a3b275439127b1cca537e05405724cbb77f1b6b8ac379f1a51fbf7c9718ccaf001ca3ccd3b6066ca6638fd393b109c48ac
-
SSDEEP
49152:Yj5ydxFPicwfraMh/qNwffAj3g/bTqSk6I8K6CH:PnDU/lgQ/6SF
Malware Config
Signatures
Files
-
Dx11 ImGui - Black Ops lll.dll.exe.dll windows x64
7ff9f777b191513395bbc28eaa66ccff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateToolhelp32Snapshot
GetCurrentThread
CloseHandle
GetThreadContext
GetCurrentProcessId
SetThreadContext
OpenThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetTickCount
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapDestroy
FlushInstructionCache
K32GetModuleInformation
GetTickCount64
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
SuspendThread
ExitThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoEx
FormatMessageA
LocalFree
GetFileInformationByHandleEx
GetLastError
AreFileApisANSI
GetCurrentThreadId
Thread32First
Thread32Next
GetModuleFileNameW
VirtualProtect
GetModuleHandleW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
ResumeThread
GetProcAddress
RtlCaptureStackBackTrace
CreateThread
IsProcessorFeaturePresent
Sleep
GetFileAttributesExW
TerminateProcess
GetModuleHandleA
user32
SetWindowLongPtrW
CreateWindowExW
UnregisterClassW
DestroyWindow
GetAsyncKeyState
CallWindowProcW
DefWindowProcW
SendMessageA
FindWindowW
FindWindowExW
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetKeyState
RegisterClassExW
shell32
SHGetSpecialFolderPathA
ShellExecuteW
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Xtime_get_ticks
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
d3dcompiler_47
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
urlmon
URLOpenBlockingStreamW
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strchr
strstr
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
__std_exception_destroy
__std_exception_copy
__std_terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
malloc
free
api-ms-win-crt-stdio-l1-1-0
fgetpos
__stdio_common_vsprintf
fopen_s
fwrite
_wfopen
ungetc
feof
fgetc
fseek
fsetpos
fclose
fflush
ferror
fread
fputc
ftell
_fseeki64
_get_stream_buffer_pointers
setvbuf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initialize_narrow_environment
terminate
_cexit
_errno
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
_initterm_e
_initterm
api-ms-win-crt-convert-l1-1-0
_atoi64
strtol
atof
strtof
atoi
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
isspace
strncmp
toupper
strtok
strcat_s
strncpy
strncpy_s
isalnum
isblank
strcmp
api-ms-win-crt-math-l1-1-0
cosf
atan2f
floorf
ceilf
sqrtf
atan2
sinf
acosf
ldexp
powf
fmodf
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 45.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ