ddrawex[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddrawex.dll
Size

40KB
MD5

27688a7b37e8d067c063d685b7f331e4
SHA1

87ede98b69dd0f5ff90d7c1d9f4eb2f8d46ab274
SHA256

72817d726f8b01e5ef1656f80874ab0d9c21414e0d83db1792bb5ca30381c479
SHA512

3c7b2bd0821a58b67e6f2d08d5debb2e4935e7f979c5da8cbbc11b61278c41e6e96d77c922861d3caa05fb92b880e095435c3b38c7cd034f633202453469f3f1
SSDEEP

768:bprEmK3i7V2+k22+YqztC9AMqpTD57FFMU/va/JNaZo42upqeC:trEmK3a2+k22+YatpdFD5PHvANa+42uq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddrawex.dll

Files

ddrawex.dll
.dll regsvr32 windows:10 windows x86 arch:x86

96a3cd6be4e28417ac1b3f3e7df77d3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ddrawex.pdb

Imports

msvcrt

memcmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
LoadLibraryExA
FreeLibrary
GetModuleFileNameA
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyExA
RegCloseKey
RegSetValueExA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExA
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringA

gdi32

CreateDIBSection
DeleteObject
CreateCompatibleDC
GetSystemPaletteEntries
DeleteDC
SetDIBColorTable
SelectObject

ddraw

ReleaseDDThreadLock
AcquireDDThreadLock

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96a3cd6be4e28417ac1b3f3e7df77d3c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

gdi32

ddraw

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 30KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 2KB - Virtual size: 2KB