ddrawex[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddrawex.dll
Size

29KB
MD5

bab9ef9a340113666f678aa2474904b6
SHA1

c08953a3ba505262afb02e113416183306af6025
SHA256

b1c6b2d704b81274d3af6a726f376d1183403732214298c051a1ce75eeb754c0
SHA512

2f44be4aac26998142b3b3c7b5f7a60c9ea29526ef3a9213aa6bfe1808bd17f07fa99beee8f02988fbb8d021d50de5165a16900a5a444dd5f99d69d034af2d4e
SSDEEP

768:g8xvO/ir8OtseN9LzpSVKEuxNi8ERzM0cfxvAjm9/DD:bxvQiwO59/pSVKNi806fxbDD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddrawex.dll

Files

ddrawex.dll
.dll regsvr32 windows:6 windows x86 arch:x86

da926bb5c3390a85a5c9251594760646

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ddrawex.pdb

Imports

msvcrt

_amsg_exit
_initterm
free
_except_handler4_common
malloc
_XcptFilter
_vsnprintf

user32

MessageBoxA
GetDC
ReleaseDC

kernel32

GetModuleFileNameA
LocalAlloc
LocalFree
lstrlenA
FreeLibrary
GetProcAddress
GetVersionExA
LoadLibraryA
DisableThreadLibraryCalls
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
GetProfileStringA
SetErrorMode

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA
RegSetValueExA

gdi32

GetSystemPaletteEntries
SelectObject
DeleteDC
CreateDIBSection
SetDIBColorTable
DeleteObject
CreateCompatibleDC

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ddraw

AcquireDDThreadLock
ReleaseDDThreadLock

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da926bb5c3390a85a5c9251594760646

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

kernel32

advapi32

gdi32

version

ddraw

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 23KB - Virtual size: 22KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 1KB - Virtual size: 1KB