d3dramp[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3dramp.dll
Size

580KB
MD5

4b1a0be7fff6620f739f938a9b694dd1
SHA1

c979b8032dfa637326360e1c6308e74b46a05eca
SHA256

16ceb3786614577b9fa74162573195e44e331e2ebbf67198e9c0488b54c070d8
SHA512

3d661694086f1828243e215c00b373c80c6b78e4b6ede596d34094e81a8645aa20cfdafaabff02fb0baeff28cfc72d5cfcb057536eb354b0a73f4d162d653016
SSDEEP

12288:PmmSgPu8dj0T7wF4SG7O8pIvDp9N2BK9f79r2z7UWiwUjjYhrhlVKEdf8dfaVkTa:xTEdkdbhnee7R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3dramp.dll

Files

d3dramp.dll
.dll windows:6 windows x86 arch:x86

dcf69a78789b9f153a1c5234d07e6d9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3dramp.pdb

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter

kernel32

Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange

Exports

Exports

RampOldTri
g_RampOld_BeadTbl

Sections

cseg
Size: 420KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dseg
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ