DispBroker[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

DispBroker.dll
Size

258KB
MD5

aa8d0fc270caffef45dc979e0ae22545
SHA1

def1a1e77f4c95634d9e3c1744ed590c22742a16
SHA256

a5dc165b2ddc91840740ade7ad90812b9df16653d2a63580ed23dbb12875230f
SHA512

4b378d84b56292a2f6bce11726f79e2307d0a43ca152985bc293909e720a0c834b02b1884dff293539f2e0b68165d47c1c2dafe80b2736360769dcb8f6a91d2e
SSDEEP

6144:jsyWi/gC5G4Pd+NCuC4vaER261hulwJ6IAr8ZyzMCJzS:jBWwD3F+NCuC4Sdeg6J6IANYCJz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DispBroker.dll

Files

DispBroker.dll
.dll windows:10 windows x86 arch:x86

27380d211e4ef1258a366b4433167fbe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DispBroker.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

wcsnlen
memset

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__callnewh
memmove
_o_free
_o_malloc
_o_realloc
_o_terminate
_except_handler4_common
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
__std_terminate
__CxxFrameHandler3
memcpy

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlIsMultiSessionSku
RtlQueryWnfStateData
NtAlpcCancelMessage
RtlGetLastNtStatus
RtlInitUnicodeString
NtAlpcCreatePort
NtAlpcSendWaitReceivePort
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
NtAlpcAcceptConnectPort

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
SetEvent
InitializeSRWLock
ReleaseSemaphore
InitializeCriticalSectionEx
CreateSemaphoreExW
ResetEvent
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
LeaveCriticalSection
OpenSemaphoreW
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
ProcessIdToSessionId
GetCurrentThreadId
CreateThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventActivityIdControl
EventRegister

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
RoTransformError
RoOriginateErrorW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCreateString

api-ms-win-ntuser-sysparams-l1-1-0

GetDisplayConfigBufferSizes
DisplayConfigGetDeviceInfo

api-ms-win-rtcore-ntuser-private-l1-1-5

ord2620
ord2619
ord2618

api-ms-win-dx-d3dkmt-l1-1-4

D3DKMTDispMgrTargetOperation
ord1016
D3DKMTDDisplayEnum
D3DKMTDispMgrCreate
D3DKMTDispMgrSourceOperation

api-ms-win-dx-d3dkmt-l1-1-0

GdiEntry13
ord1004

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?_Xlength_error@std@@YAXPBD@Z

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-memory-l1-1-0

VirtualFree

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27380d211e4ef1258a366b4433167fbe

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-rtcore-ntuser-private-l1-1-5

api-ms-win-dx-d3dkmt-l1-1-4

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

msvcp_win

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 231KB - Virtual size: 231KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 231KB - Virtual size: 231KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 17KB - Virtual size: 17KB