d3d9.pdb
Behavioral task
behavioral1
Sample
DuiDui.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
DuiDui.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
d3d9.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
d3d9.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
fmod.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
fmod.dll
Resource
win10v2004-20231215-en
General
-
Target
8908e4420ba4b2172566d9ffd2138922
-
Size
1.5MB
-
MD5
8908e4420ba4b2172566d9ffd2138922
-
SHA1
bedac348a9d7dd3d5360fa0bc76c6ec6ba6990bb
-
SHA256
f79bf097d63b79ddae0dd2072290d230cc09f5fa8d4c6d122d6fc252ad1d1cec
-
SHA512
cec280fc22b83cd0162ac8e3ea45b0e05a276b02a54633c7016a6731a5ef9e4afa74233227bceedaa055d970ca50df8a4941e95c07d59324160bdf33c63ad2b4
-
SSDEEP
24576:8RJpYaViRpBr2dKPA7HY1SqRbVvs5b6FGKi9ACauDoTsCKXrFYfVQijmJ4CODAb3:8RJpYaoYR7HY4e46KACauMTszbFYfVQJ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/fmod.dll acprotect -
resource yara_rule static1/unpack001/DuiDui.exe aspack_v212_v242 -
resource yara_rule static1/unpack001/fmod.dll upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/DuiDui.exe unpack001/d3d9.dll unpack001/fmod.dll
Files
-
8908e4420ba4b2172566d9ffd2138922.rar
-
DuiDui.asdb
-
DuiDui.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 217KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DuiDui.mid
-
DuiDui.s3m
-
d3d9.dll.dll windows:5 windows x86 arch:x86
55a62a90b08398ec62d55e048313fce8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
d3d8thk
OsThunkDdSetGammaRamp
OsThunkDdCreateSurfaceEx
OsThunkDdCreateSurface
OsThunkDdCreateD3DBuffer
OsThunkDdAttachSurface
OsThunkDdCreateSurfaceObject
OsThunkDdCanCreateSurface
OsThunkDdCanCreateD3DBuffer
OsThunkD3dContextCreate
OsThunkD3dContextDestroy
OsThunkD3dContextDestroyAll
OsThunkDdGetDriverState
OsThunkD3dValidateTextureStageState
OsThunkD3dDrawPrimitives2
OsThunkDdGetScanLine
OsThunkDdDestroySurface
OsThunkDdQueryDirectDrawObject
OsThunkDdBlt
OsThunkDdFlip
OsThunkDdReleaseDC
OsThunkDdGetDC
OsThunkDdDeleteDirectDrawObject
OsThunkDdGetDriverInfo
OsThunkDdQueryMoCompStatus
OsThunkDdRenderMoComp
OsThunkDdEndMoCompFrame
OsThunkDdBeginMoCompFrame
OsThunkDdDestroyMoComp
OsThunkDdCreateMoComp
OsThunkDdGetMoCompBuffInfo
OsThunkDdGetInternalMoCompInfo
OsThunkDdGetMoCompFormats
OsThunkDdGetMoCompGuids
OsThunkDdGetAvailDriverMemory
OsThunkDdFlipToGDISurface
OsThunkDdSetExclusiveMode
OsThunkDdWaitForVerticalBlank
OsThunkDdGetFlipStatus
OsThunkDdGetBltStatus
OsThunkDdUnlock
OsThunkDdUnlockD3D
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdResetVisrgn
OsThunkDdReenableDirectDrawObject
OsThunkDdDeleteSurfaceObject
OsThunkDdDestroyD3DBuffer
msvcrt
calloc
_onexit
__dllonexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
memmove
realloc
free
malloc
strstr
isalnum
sscanf
_purecall
_strlwr
wcsrchr
atoi
ceil
_stricmp
_vsnprintf
_CIpow
floor
__CxxFrameHandler
_snprintf
qsort
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
fflush
fwrite
??0exception@@QAE@ABV0@@Z
fopen
sprintf
strchr
??0exception@@QAE@XZ
fclose
_CxxThrowException
user32
PtInRect
GetCursorPos
SetCursorPos
GetCursor
SetCursor
DestroyIcon
GetDesktopWindow
GetWindowDC
CreateIconIndirect
mouse_event
SetForegroundWindow
SetRect
GetClientRect
ClientToScreen
EnumDisplaySettingsA
OffsetRect
IntersectRect
GetSystemMetrics
LoadStringA
GetMonitorInfoA
GetDC
ReleaseDC
SystemParametersInfoA
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
IsWindow
GetWindowThreadProcessId
KillTimer
SetWindowLongA
CallWindowProcA
SendMessageA
IsIconic
PostMessageA
GetWindowLongA
GetKeyState
DefWindowProcA
SetWindowPos
GetForegroundWindow
IsWindowVisible
ShowWindow
IsZoomed
SetTimer
ChangeDisplaySettingsA
wsprintfA
advapi32
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
RegOpenKeyA
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
winmm
timeEndPeriod
timeBeginPeriod
gdi32
DeleteDC
GetNearestColor
CreateDCA
GdiEntry13
GetRegionData
DeleteObject
GetRandomRgn
CreateRectRgn
GetDIBits
CreateCompatibleBitmap
GetDeviceGammaRamp
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
SetStretchBltMode
BitBlt
GdiEntry1
GetSystemPaletteEntries
CreateDIBitmap
GetDeviceCaps
kernel32
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
LocalFree
LocalAlloc
VerSetConditionMask
ReleaseMutex
GetCurrentThread
SetThreadPriority
ResumeThread
SetThreadAffinityMask
GetProcessAffinityMask
GetTempPathA
TlsGetValue
TlsSetValue
GetEnvironmentVariableA
TlsAlloc
GetSystemInfo
WideCharToMultiByte
CreateThread
ExitThread
SetEvent
WaitForMultipleObjects
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
DebugBreak
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
VerifyVersionInfoA
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
CloseHandle
GetVersionExA
CreateFileA
MultiByteToWideChar
GetCurrentProcess
SetFilePointer
ReadFile
MoveFileA
DeleteFileA
WriteFile
GetFileSize
GetModuleFileNameA
GetPrivateProfileStringA
ConnectNamedPipe
SetNamedPipeHandleState
DisconnectNamedPipe
FlushFileBuffers
GetCurrentThreadId
PeekNamedPipe
TransactNamedPipe
WaitNamedPipeA
CreateNamedPipeA
CreateEventA
lstrcmpA
GetLastError
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
InterlockedExchange
SetErrorMode
InterlockedDecrement
GetSystemDirectoryA
GetModuleHandleA
lstrcpynA
OutputDebugStringA
GetNativeSystemInfo
OpenMutexA
CreateMutexA
DisableThreadLibraryCalls
GetCurrentProcessId
InterlockedCompareExchange
Exports
Exports
CheckFullscreen
D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
DebugSetLevel
DebugSetMute
Direct3DCreate9
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
fmod.dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
_FMUSIC_FreeSong@4
_FMUSIC_GetBPM@4
_FMUSIC_GetGlobalVolume@4
_FMUSIC_GetMasterVolume@4
_FMUSIC_GetName@4
_FMUSIC_GetNumChannels@4
_FMUSIC_GetNumInstruments@4
_FMUSIC_GetNumOrders@4
_FMUSIC_GetNumPatterns@4
_FMUSIC_GetNumSamples@4
_FMUSIC_GetOpenState@4
_FMUSIC_GetOrder@4
_FMUSIC_GetPattern@4
_FMUSIC_GetPatternLength@8
_FMUSIC_GetPaused@4
_FMUSIC_GetRealChannel@8
_FMUSIC_GetRow@4
_FMUSIC_GetSample@8
_FMUSIC_GetSpeed@4
_FMUSIC_GetTime@4
_FMUSIC_GetType@4
_FMUSIC_GetUserData@4
_FMUSIC_IsFinished@4
_FMUSIC_IsPlaying@4
_FMUSIC_LoadSong@4
_FMUSIC_LoadSongEx@24
_FMUSIC_OptimizeChannels@12
_FMUSIC_PlaySong@4
_FMUSIC_SetInstCallback@12
_FMUSIC_SetLooping@8
_FMUSIC_SetMasterSpeed@8
_FMUSIC_SetMasterVolume@8
_FMUSIC_SetOrder@8
_FMUSIC_SetOrderCallback@12
_FMUSIC_SetPanSeperation@8
_FMUSIC_SetPaused@8
_FMUSIC_SetReverb@4
_FMUSIC_SetRowCallback@12
_FMUSIC_SetSample@12
_FMUSIC_SetUserData@8
_FMUSIC_SetZxxCallback@8
_FMUSIC_StopAllSongs@0
_FMUSIC_StopSong@4
_FSOUND_3D_GetAttributes@12
_FSOUND_3D_GetMinMaxDistance@12
_FSOUND_3D_Listener_GetAttributes@32
_FSOUND_3D_Listener_SetAttributes@32
_FSOUND_3D_Listener_SetCurrent@8
_FSOUND_3D_SetAttributes@12
_FSOUND_3D_SetDistanceFactor@4
_FSOUND_3D_SetDopplerFactor@4
_FSOUND_3D_SetMinMaxDistance@12
_FSOUND_3D_SetRolloffFactor@4
_FSOUND_CD_Eject@4
_FSOUND_CD_GetNumTracks@4
_FSOUND_CD_GetPaused@4
_FSOUND_CD_GetTrack@4
_FSOUND_CD_GetTrackLength@8
_FSOUND_CD_GetTrackTime@4
_FSOUND_CD_GetVolume@4
_FSOUND_CD_OpenTray@8
_FSOUND_CD_Play@8
_FSOUND_CD_SetPaused@8
_FSOUND_CD_SetPlayMode@8
_FSOUND_CD_SetTrackTime@8
_FSOUND_CD_SetVolume@8
_FSOUND_CD_Stop@4
_FSOUND_Close@0
_FSOUND_DSP_ClearMixBuffer@0
_FSOUND_DSP_Create@12
_FSOUND_DSP_Free@4
_FSOUND_DSP_GetActive@4
_FSOUND_DSP_GetBufferLength@0
_FSOUND_DSP_GetBufferLengthTotal@0
_FSOUND_DSP_GetClearUnit@0
_FSOUND_DSP_GetClipAndCopyUnit@0
_FSOUND_DSP_GetFFTUnit@0
_FSOUND_DSP_GetMusicUnit@0
_FSOUND_DSP_GetPriority@4
_FSOUND_DSP_GetSFXUnit@0
_FSOUND_DSP_GetSpectrum@0
_FSOUND_DSP_MixBuffers@28
_FSOUND_DSP_SetActive@8
_FSOUND_DSP_SetPriority@8
_FSOUND_FX_Disable@4
_FSOUND_FX_Enable@8
_FSOUND_FX_SetChorus@32
_FSOUND_FX_SetCompressor@28
_FSOUND_FX_SetDistortion@24
_FSOUND_FX_SetEcho@24
_FSOUND_FX_SetFlanger@32
_FSOUND_FX_SetGargle@12
_FSOUND_FX_SetI3DL2Reverb@52
_FSOUND_FX_SetParamEQ@16
_FSOUND_FX_SetWavesReverb@20
_FSOUND_File_SetCallbacks@20
_FSOUND_GetAmplitude@4
_FSOUND_GetCPUUsage@0
_FSOUND_GetChannelsPlaying@0
_FSOUND_GetCurrentLevels@12
_FSOUND_GetCurrentPosition@4
_FSOUND_GetCurrentSample@4
_FSOUND_GetDriver@0
_FSOUND_GetDriverCaps@8
_FSOUND_GetDriverName@4
_FSOUND_GetError@0
_FSOUND_GetFrequency@4
_FSOUND_GetLoopMode@4
_FSOUND_GetMaxChannels@0
_FSOUND_GetMaxSamples@0
_FSOUND_GetMemoryStats@8
_FSOUND_GetMixer@0
_FSOUND_GetMute@4
_FSOUND_GetNumDrivers@0
_FSOUND_GetNumHWChannels@12
_FSOUND_GetNumHardwareChannels@0
_FSOUND_GetNumSubChannels@4
_FSOUND_GetOutput@0
_FSOUND_GetOutputHandle@0
_FSOUND_GetOutputRate@0
_FSOUND_GetPan@4
_FSOUND_GetPaused@4
_FSOUND_GetPriority@4
_FSOUND_GetReserved@4
_FSOUND_GetSFXMasterVolume@0
_FSOUND_GetSubChannel@8
_FSOUND_GetSurround@4
_FSOUND_GetVersion@0
_FSOUND_GetVolume@4
_FSOUND_Init@12
_FSOUND_IsPlaying@4
_FSOUND_PlaySound@8
_FSOUND_PlaySoundEx@16
_FSOUND_Record_GetDriver@0
_FSOUND_Record_GetDriverName@4
_FSOUND_Record_GetNumDrivers@0
_FSOUND_Record_GetPosition@0
_FSOUND_Record_SetDriver@4
_FSOUND_Record_StartSample@8
_FSOUND_Record_Stop@0
_FSOUND_Reverb_GetChannelProperties@8
_FSOUND_Reverb_GetProperties@4
_FSOUND_Reverb_SetChannelProperties@8
_FSOUND_Reverb_SetProperties@4
_FSOUND_Sample_Alloc@28
_FSOUND_Sample_Free@4
_FSOUND_Sample_Get@4
_FSOUND_Sample_GetDefaults@20
_FSOUND_Sample_GetDefaultsEx@32
_FSOUND_Sample_GetLength@4
_FSOUND_Sample_GetLoopPoints@12
_FSOUND_Sample_GetMinMaxDistance@12
_FSOUND_Sample_GetMode@4
_FSOUND_Sample_GetName@4
_FSOUND_Sample_Load@20
_FSOUND_Sample_Lock@28
_FSOUND_Sample_SetDefaults@20
_FSOUND_Sample_SetDefaultsEx@32
_FSOUND_Sample_SetLoopPoints@12
_FSOUND_Sample_SetMaxPlaybacks@8
_FSOUND_Sample_SetMinMaxDistance@12
_FSOUND_Sample_SetMode@8
_FSOUND_Sample_Unlock@20
_FSOUND_Sample_Upload@12
_FSOUND_SetBufferSize@4
_FSOUND_SetCurrentPosition@8
_FSOUND_SetDriver@4
_FSOUND_SetFrequency@8
_FSOUND_SetFrequencyEx@8
_FSOUND_SetHWND@4
_FSOUND_SetLoopMode@8
_FSOUND_SetMaxHardwareChannels@4
_FSOUND_SetMemorySystem@20
_FSOUND_SetMinHardwareChannels@4
_FSOUND_SetMixer@4
_FSOUND_SetMute@8
_FSOUND_SetOutput@4
_FSOUND_SetPan@8
_FSOUND_SetPanSeperation@4
_FSOUND_SetPaused@8
_FSOUND_SetPriority@8
_FSOUND_SetReserved@8
_FSOUND_SetSFXMasterVolume@4
_FSOUND_SetSpeakerMode@4
_FSOUND_SetSurround@8
_FSOUND_SetVolume@8
_FSOUND_SetVolumeAbsolute@8
_FSOUND_StopSound@4
_FSOUND_Stream_AddSyncPoint@12
_FSOUND_Stream_Close@4
_FSOUND_Stream_Create@20
_FSOUND_Stream_CreateDSP@16
_FSOUND_Stream_DeleteSyncPoint@4
_FSOUND_Stream_FindTagField@20
_FSOUND_Stream_GetLength@4
_FSOUND_Stream_GetLengthMs@4
_FSOUND_Stream_GetMode@4
_FSOUND_Stream_GetNumSubStreams@4
_FSOUND_Stream_GetNumSyncPoints@4
_FSOUND_Stream_GetNumTagFields@8
_FSOUND_Stream_GetOpenState@4
_FSOUND_Stream_GetPosition@4
_FSOUND_Stream_GetSample@4
_FSOUND_Stream_GetSyncPoint@8
_FSOUND_Stream_GetSyncPointInfo@8
_FSOUND_Stream_GetTagField@24
_FSOUND_Stream_GetTime@4
_FSOUND_Stream_Net_GetBufferProperties@12
_FSOUND_Stream_Net_GetLastServerStatus@0
_FSOUND_Stream_Net_GetStatus@20
_FSOUND_Stream_Net_SetBufferProperties@12
_FSOUND_Stream_Net_SetMetadataCallback@12
_FSOUND_Stream_Net_SetNetDataCallback@8
_FSOUND_Stream_Net_SetProxy@4
_FSOUND_Stream_Open@16
_FSOUND_Stream_Play@8
_FSOUND_Stream_PlayEx@16
_FSOUND_Stream_SetBufferSize@4
_FSOUND_Stream_SetEndCallback@12
_FSOUND_Stream_SetLoopCount@8
_FSOUND_Stream_SetLoopPoints@12
_FSOUND_Stream_SetMode@8
_FSOUND_Stream_SetPCM@8
_FSOUND_Stream_SetPosition@8
_FSOUND_Stream_SetSubStream@8
_FSOUND_Stream_SetSubStreamSentence@12
_FSOUND_Stream_SetSyncCallback@12
_FSOUND_Stream_SetTime@8
_FSOUND_Stream_Stop@4
_FSOUND_Update@0
Sections
UPX0 Size: - Virtual size: 436KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 146KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
readme.txt
-
wav/Cat.wav
-
wav/Cattle.wav
-
wav/Chichen.wav
-
wav/Dog.wav
-
wav/Err.wav
-
wav/Frog.wav
-
wav/GameOver.wav
-
wav/Go.wav
-
wav/Help.wav
-
wav/Lala1.wav
-
wav/Lala2.wav
-
wav/Monkey.wav
-
wav/PLAY.TMP
-
wav/Panda.wav
-
wav/Pause.wav
-
wav/Sel.wav
-
wav/下载说明.htm.html .js polyglot
-
下载说明.htm.html .js polyglot