ddisplay[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ddisplay.dll
Size

218KB
MD5

c223ca1d43004ad64827e02403deafbc
SHA1

83c1b65136d9a328cfda6d5fbe35ab4fc057595f
SHA256

303bcaa464576d1dc7440a928a8180d7f5701ee7bf0034492be899cb3a7bb83a
SHA512

ee68f31563f78c27c3113c61821e0908eabd94d6434eadc094fd6f51f99b6e1c4be2c45ac869920b85001c77360b80d5253f3d07e5eff8b64d1361bebbe6e2b3
SSDEEP

6144:JGYYF5VoJSq4lEYKTS7IUPZGoGkEak+NQR:JnYF5S4q4lEYV7IubTEh2Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddisplay.dll

Files

ddisplay.dll
.dll windows:10 windows x86 arch:x86

023f1ab6fed39a643d7769ead83e8962

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ddisplay.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
_o___stdio_common_vsnprintf_s
_except_handler4_common
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
_o___stdio_common_vswprintf
__std_type_info_compare
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

EtwEventWriteTransfer
EtwEventActivityIdControl
RtlSubscribeWnfStateChangeNotification
EtwEventUnregister
RtlInitUnicodeString
EtwEventSetInformation
EtwEventRegister
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlIsMultiSessionSku

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSemaphore
CreateEventA
CreateEventExW
CreateMutexExW
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDuplicateString

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError
RoTransformError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler

api-ms-win-ntuser-sysparams-l1-1-0

DisplayConfigGetDeviceInfo

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernelbase

BaseFormatObjectAttributes

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

023f1ab6fed39a643d7769ead83e8962

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

msvcp_win

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-robuffer-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

dxgi

d3d11

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

kernelbase

Exports

Exports

Sections

.text Size: 195KB - Virtual size: 195KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 164B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 195KB - Virtual size: 195KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 164B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 12KB