dciman32[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

dciman32.dll
Size

14KB
MD5

6e3381152091034dd1773c7b5d0b85e5
SHA1

1ecd1a2cb80f7118436dff16316dad9a6d4c969f
SHA256

7c4723736ddaf3fd87434475170610aced43f95a346fe96a18797b193abb5eea
SHA512

8ed1ff6267b4db42bbba9d98d46e68e6432623f2091cabcddee7bc3ec00689b3e7c5564691d041806bbd86abc69c4a36dda487f5dc1d4b3d858e8b2a767b6ee0
SSDEEP

192:egEsy5pGt9pOb2wlorVwZPy0eOXPdxF/NmatE75oLns7o40+ZfKW7OW:pq5gw/irq/dPdxFQee5o4k6fKW7OW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dciman32.dll

Files

dciman32.dll
.dll windows:6 windows x64 arch:x64

ca5eb643f8fcd1f086d6e0983c96df12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dciman32.pdb

Imports

msvcrt

memcpy
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

kernel32

GetCurrentProcessId
TerminateProcess
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
GetModuleHandleW
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
LocalAlloc
LocalFree
Sleep
QueryPerformanceCounter
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter

gdi32

GdiEntry1
GdiEntry10
DeleteDC
GdiEntry3
GdiEntry6
GetRandomRgn
CreateDCW
GetRegionData
DeleteObject
CreateRectRgn
GdiEntry2

user32

ReleaseDC
GetDC
GetSystemMetrics

Exports

Exports

DCIBeginAccess
DCICloseProvider
DCICreateOffscreen
DCICreateOverlay
DCICreatePrimary
DCIDestroy
DCIDraw
DCIEndAccess
DCIEnum
DCIOpenProvider
DCISetClipList
DCISetDestination
DCISetSrcDestClip
GetDCRegionData
GetWindowRegionData
WinWatchClose
WinWatchDidStatusChange
WinWatchGetClipList
WinWatchNotify
WinWatchOpen

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca5eb643f8fcd1f086d6e0983c96df12

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

gdi32

user32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 636B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 512B - Virtual size: 32B

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 636B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 512B - Virtual size: 32B