cdd[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cdd.dll
Size

202KB
MD5

b9a78edb7632ef38cb5e5a571df473b0
SHA1

0b7618531ee99b926ab7be88483207419abe42e0
SHA256

7f3600a7f17f141eb0ed8dec2c37716bd9325c5ff1d89213ef6fc17216ba622a
SHA512

a99e8b7dc43626165aeeea8a5d0cf173fe2be056419fbbff7697e2c31a7a23107c232f4f0bd7a66ba5b341b29ef2773e5cd210d46566714e399f15d8ed9e25eb
SSDEEP

3072:jUA4ol59WRtTaCfZPXe3vppnBzw//YxaLiHl9On6ieLlXuDy1l6WEhNySV:wI9W7GY03h3M/dI9On6iW9S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdd.dll

Files

cdd.dll
.dll windows:6 windows x64 arch:x64

bae0340fe418281adf699447a7f1d912

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

cdd.pdb

Imports

win32k.sys

EngCreateSemaphore
EngDeleteSemaphore
EngCreateRectRgn
EngDeleteRgn
EngUnlockSurface
EngDeleteSurface
EngModifySurface
EngAcquireSemaphore
EngReleaseSemaphore
EngCreateDeviceSurface
EngCreateBitmap
EngLockSurface
EngAssociateSurface
EngSetRectRgn
RtlCopyMemoryNonTemporal
CLIPOBJ_cEnumStart
CLIPOBJ_bEnum
EngGetRgnData
EngCombineRgn
EngGetRgnBox
EngRectInRgn
EngIsSemaphoreOwned
EngCTGetGammaTable
EngCreateRedirectionDeviceBitmap
EngCreateDeviceBitmap
EngIsSemaphoreOwnedByCurrentThread
EngQueryW32kCddInterface
EngDeletePalette
EngFreeMem
PALOBJ_cGetColors
EngCopyBits
EngUpdateDeviceSurface
EngAcquireSemaphoreNoWait
EngIsSemaphoreSharedByCurrentThread
EngAcquireSemaphoreSharedNoWait
EngEqualRgn
PATHOBJ_vGetBounds
EngStrokePath
EngBitBlt
XLATEOBJ_iXlate
EngTransparentBlt
EngAlphaBlend
EngGradientFill
EngStretchBlt
EngCopyRgn
EngOffsetRgn
EngTextOut
EngCTGetCurrentGamma
EngLineTo
EngFillPath
EngStrokeAndFillPath
EngStretchBltROP
EngPlgBlt
EngIsCddDeviceBitmap
EngBugCheckEx
EngCreatePalette
EngAllocMem
__C_specific_handler

ntoskrnl.exe

ExQueryWnfStateData
ExIsProcessorFeaturePresent
KeGetRecommendedSharedDataAlignment
ExAllocatePoolWithTag
KeInitializeEvent
RtlQueryRegistryValuesEx
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
KeInitializeMutex
ObfDereferenceObject
MmUnlockPages
MmUnmapViewInSessionSpace
MmCreateSection
MmMapViewInSessionSpace
MmSizeOfMdl
MmProbeAndLockPages
PsGetProcessImageFileName
PsGetCurrentProcess
KeSetEvent
MmUnmapViewOfSection
KeSetActualBasePriorityThread
KeInitializeTimer
KeSetTimer
KeWaitForMultipleObjects
KeReadStateEvent
KeClearEvent
DbgPrintEx
vsprintf_s
KeCancelTimer
ObOpenObjectByPointer
PsCreateSystemThread
KeWaitForSingleObject
ZwClose
ObfReferenceObject
KeStackAttachProcess
KeUnstackDetachProcess
ExAcquirePushLockExclusiveEx
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleasePushLockExclusiveEx
RtlInitUnicodeString
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
IofCallDriver
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlInsertElementGenericTableFullAvl
RtlEnumerateGenericTableAvl
ObDuplicateObject
ObCloseHandle
KeReleaseSemaphore
KeQueryTimeIncrement
IoAllocateMdl
IoFreeMdl
KeInvalidateRangeAllCaches
MmMapViewOfSection
wcsncmp
KeReleaseMutex
ZwSetSystemInformation
_wcsnicmp
KeInitializeSemaphore
ZwQuerySystemInformation
ExFreePoolWithTag

hal

KeQueryPerformanceCounter

watchdog.sys

WdLogEvent5_WdAssertion
WdLogNewEntry5_WdEvent
WdLogEvent5_WdEvent
WdLogNewEntry5_WdWarning
WdLogEvent5_WdWarning
WdLogNewEntry5_WdError
WdLogEvent5_WdError
WdLogNewEntry5_WdLowResource
WdLogEvent5_WdLowResource
WdLogNewEntry5_WdTrace
SMgrGdiCallout
WdLogNewEntry5_WdAssertion

Sections

.text
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bae0340fe418281adf699447a7f1d912

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

win32k.sys

ntoskrnl.exe

hal

watchdog.sys

Sections

.text Size: 174KB - Virtual size: 173KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 6KB - Virtual size: 5KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 512B - Virtual size: 376B

.text
Size: 174KB - Virtual size: 173KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 6KB - Virtual size: 5KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 512B - Virtual size: 376B