C:\Users\fabro\Documents\shield-development\build\bin\x64\Debug\d3d11.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d3d11.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d3d11.dll
Resource
win10v2004-20240226-en
General
-
Target
d3d11.dll
-
Size
6.1MB
-
MD5
a0101eca2081967d9395ab55a3179384
-
SHA1
2a37e3af1f51878523a66bac0e72003a1a2a74de
-
SHA256
680141618c709719ae4c5c76256c8380d0eb0906f63410604f03a3a525c28387
-
SHA512
c69a2ef414ece50cc1c29416157ae8c0d3e702e58cce1ccf3b9a4bbf69c56c40421377e1b80fd773295cebe5f069ea030332b40bd79bb82c75f29ef8f4729734
-
SSDEEP
49152:I5gAM1skTG0ifk5RVzrRRdENTfjJQ3dmmoBC00XyjN/H5PWvJ4+Ugp1LU1krkQ2l:wVQrItQHyjMkz4n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3d11.dll
Files
-
d3d11.dll.dll windows:6 windows x64 arch:x64
2af3a3e7714591bc93905992f7309983
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetSystemDirectoryA
DecodePointer
GetLastError
SetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
IsBadReadPtr
GetCurrentThreadId
SetUnhandledExceptionFilter
RtlUnwind
SetThreadContext
GetThreadContext
RtlCaptureStackBackTrace
HeapCreate
GetTickCount
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetProcAddress
CreateThread
GetCurrentProcessId
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
InitializeCriticalSection
OutputDebugStringA
TerminateProcess
GetCurrentProcess
HeapDestroy
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
HeapQueryInformation
HeapReAlloc
SetConsoleCtrlHandler
WriteFile
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
CreateProcessA
VirtualProtect
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
LoadResource
LockResource
SizeofResource
LoadLibraryA
FindResourceA
FlushInstructionCache
VirtualAlloc
VirtualFree
GlobalUnlock
GlobalLock
GetCurrentThread
OpenThread
SuspendThread
ResumeThread
GetThreadId
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateFileA
FlushFileBuffers
ReadFile
SetFilePointer
GetTempPathA
GetTempFileNameA
DeleteFileA
MoveFileA
VirtualQuery
GetSystemFirmwareTable
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
WideCharToMultiByte
WaitForSingleObjectEx
Sleep
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
LocalFree
FormatMessageA
GetLocaleInfoEx
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
LoadLibraryExW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
EncodePointer
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
HeapSize
HeapValidate
GetSystemInfo
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
CreateMutexExA
user32
MessageBoxA
ShowCursor
GetAsyncKeyState
TranslateMessage
DispatchMessageW
PeekMessageW
GetWindowTextA
DefWindowProcA
PostQuitMessage
RegisterClassA
UnregisterClassA
CreateWindowExA
GetClipboardData
CloseClipboard
GetWindowTextW
SendMessageA
OpenClipboard
LoadIconA
LoadCursorA
AdjustWindowRect
GetWindowRect
UpdateWindow
GetSystemMetrics
SetWindowPos
ShowWindow
DestroyWindow
IsWindow
gdi32
CreateBitmap
DeleteObject
advapi32
CryptAcquireContextW
RegOpenKeyExW
RegCloseKey
GetUserNameA
RegQueryValueExW
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
shell32
ShellExecuteA
ws2_32
__WSAFDIsSet
closesocket
connect
ioctlsocket
getpeername
getsockname
recv
recvfrom
select
send
sendto
gethostbyname
WSASetLastError
getaddrinfo
freeaddrinfo
dbghelp
MiniDumpWriteDump
Exports
Exports
D3D11CreateDevice
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 101KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ