cdd[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cdd.dll
Size

222KB
MD5

239e89cb039ebef24afcf6e260cdb176
SHA1

d44c2c9d4f32bf8f946a5a7ad88a21ae7ac213a2
SHA256

3ef42ff594b9bde4efe03fdc54df2ae1046316034901ad0e89abf7b061750dc1
SHA512

58c2385dbc22bcfb27c3e000924e19f90ed18b8d361c7fec6d761011ac67c5fa784cdc2a7063497387a2bfb986d2dc70cad51617d71ac0ea085d305f64173875
SSDEEP

6144:Uggd/pK5qfksnWjNcM6ipMg74/LAmbcWrp+dTOZV:UggEcBnWJcM62M/TT+dy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdd.dll

Files

cdd.dll
.dll windows:10 windows x64 arch:x64

bd74bec23b1e4efd5093ed753917468e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

cdd.pdb

Imports

win32k.sys

EngFreeMem
EngAllocMem
EngCreateSemaphore
EngDeleteSemaphore
EngCreateRectRgn
EngDeleteRgn
EngUnlockSurface
EngDeleteSurface
EngModifySurface
EngAcquireSemaphore
EngReleaseSemaphore
EngCreateDeviceSurface
EngCreateBitmap
EngLockSurface
EngAssociateSurface
EngSetRectRgn
RtlCopyMemoryNonTemporal
CLIPOBJ_cEnumStart
CLIPOBJ_bEnum
EngGetRgnData
EngCombineRgn
EngGetRgnBox
EngRectInRgn
EngIsSemaphoreOwned
EngCTGetGammaTable
EngCreateRedirectionDeviceBitmap
EngCreateDeviceBitmap
EngIsSemaphoreOwnedByCurrentThread
EngQueryW32kCddInterface
EngDeletePalette
EngCreatePalette
PALOBJ_cGetColors
EngCopyBits
EngUpdateDeviceSurface
EngAcquireSemaphoreNoWait
EngIsSemaphoreSharedByCurrentThread
EngAcquireSemaphoreSharedNoWait
EngEqualRgn
PATHOBJ_vGetBounds
EngStrokePath
EngBitBlt
XLATEOBJ_iXlate
EngTransparentBlt
EngAlphaBlend
EngGradientFill
EngStretchBlt
EngCopyRgn
EngOffsetRgn
EngTextOut
EngCTGetCurrentGamma
EngLineTo
EngFillPath
EngStrokeAndFillPath
EngStretchBltROP
EngPlgBlt
EngIsCddDeviceBitmap
EngBugCheckEx
__C_specific_handler

ntoskrnl.exe

EtwSetInformation
EtwRegister
EtwUnregister
KeInitializeSemaphore
KeInitializeMutex
ExQueryWnfStateData
ExIsProcessorFeaturePresent
KeGetRecommendedSharedDataAlignment
KdDebuggerEnabled
DbgPrint
ExAllocatePoolWithTag
ZwQuerySystemInformation
RtlQueryRegistryValuesEx
ExFreePoolWithTag
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
ObfDereferenceObject
MmUnlockPages
MmUnmapViewInSessionSpace
MmCreateSection
MmMapViewInSessionSpace
MmSizeOfMdl
MmProbeAndLockPages
PsGetProcessImageFileName
PsGetCurrentProcess
KeSetEvent
_purecall
MmUnmapViewOfSection
ObfReferenceObject
KeDelayExecutionThread
KeSetActualBasePriorityThread
KeInitializeTimer
KeSetTimer
KeWaitForMultipleObjects
KeReadStateEvent
KeClearEvent
DbgPrintEx
vsprintf_s
KeCancelTimer
ObOpenObjectByPointer
PsCreateSystemThread
KeWaitForSingleObject
ZwClose
EtwActivityIdControl
KeStackAttachProcess
KeUnstackDetachProcess
ExAcquirePushLockExclusiveEx
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleasePushLockExclusiveEx
RtlInitUnicodeString
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
IofCallDriver
ObReferenceObjectByHandle
ObDuplicateObject
ObCloseHandle
KeReleaseSemaphore
KeQueryTimeIncrement
EtwWriteTransfer
IoAllocateMdl
IoFreeMdl
KeInvalidateRangeAllCaches
MmMapViewOfSection
KeReleaseMutex
ZwSetSystemInformation
_wcsnicmp
KeInitializeEvent

watchdog.sys

WdLogNewEntry5_WdAssertion
WdLogNewEntry5_WdEvent
WdLogEvent5_WdEvent
WdLogNewEntry5_WdWarning
WdLogEvent5_WdWarning
WdLogNewEntry5_WdError
WdLogEvent5_WdError
WdLogNewEntry5_WdLowResource
WdLogEvent5_WdLowResource
WdLogNewEntry5_WdTrace
SMgrGdiCallout
WdLogEvent5_WdAssertion

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd74bec23b1e4efd5093ed753917468e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

win32k.sys

ntoskrnl.exe

watchdog.sys

Sections

.text Size: 189KB - Virtual size: 189KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 7KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 5KB

PAGE Size: 512B - Virtual size: 268B

GFIDS Size: 1024B - Virtual size: 676B

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 512B - Virtual size: 472B

.text
Size: 189KB - Virtual size: 189KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 7KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 5KB

PAGE
Size: 512B - Virtual size: 268B

GFIDS
Size: 1024B - Virtual size: 676B

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 512B - Virtual size: 472B