DWrite[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

DWrite.dll
Size

1.9MB
MD5

d8dee8fea20706b4f5d0eb5106a2fd25
SHA1

906c3381455278d2be27db4bc7af52687fed8cff
SHA256

8410c029df2d3e535838b3e9c318398a230563a8c4e3aafa26cdb59670f759e8
SHA512

948718d8b9e5ed28f6b568aae2f5e04d82470a5ff7aa1e943339ae1217f6d76ae71985b2f677cdc1be7fa997ce3e9fd941ed71f028ce6c34f9cb34af6022f63a
SSDEEP

24576:3ZeP1qaJJfTM+/iwUKlsnfiJgSKRlpYsnIcs3qL/v:3UP1qaJlO5K+nqJgR/YJ3yv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DWrite.dll

Files

DWrite.dll
.dll windows:6 windows x64 arch:x64

0388ec8e6b9595e86978f15a9822add7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DWrite.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
realloc
sqrt
_onexit
__dllonexit
_unlock
_purecall
_lock
calloc
wcsnlen
iswalpha
pow
??0exception@@QEAA@XZ
memmove_s
memset
memcpy
memcmp
abort
wcschr
_ultow_s
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__CxxFrameHandler3
_CxxThrowException
_callnewh
memmove
wcsrchr
__C_specific_handler
_initterm
??0exception@@QEAA@AEBQEBD@Z
malloc
_wcsicmp
sprintf_s
free
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
logf
floorf
expf
ceilf
_amsg_exit
_XcptFilter
sqrtf

ntdll

WinSqmCommonDatapointSetDWORD
WinSqmIsOptedIn
RtlInitUnicodeString
NtClose
NtSetInformationThread
NtQueryInformationThread
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStreamEx

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
LockResource
LoadResource
FindResourceExW
SizeofResource

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
ResetEvent
WaitForMultipleObjectsEx
InitializeCriticalSection
DeleteCriticalSection
SetEvent
Sleep
CreateEventW
WaitForSingleObjectEx
EnterCriticalSection

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
GetSystemInfo

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
RaiseException

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegGetValueW

api-ms-win-core-localization-l1-2-1

LocaleNameToLCID
LCMapStringW
GetLocaleInfoEx
GetUserDefaultLCID
GetSystemDefaultLCID
GetACP

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
CompareStringW

api-ms-win-core-file-l1-2-1

FindNextChangeNotification
FindFirstFileW
FindClose
FindFirstChangeNotificationW
ReadFile
CreateFileW
FindCloseChangeNotification
GetFileInformationByHandle

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree
VirtualQuery
CreateFileMappingW
UnmapViewOfFile
MapViewOfFileEx

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-localization-obsolete-l1-2-0

LCIDToLocaleName

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventEnabled
EventWrite

api-ms-win-security-base-l1-2-0

CreateWellKnownSid

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DWriteCreateFactory

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0388ec8e6b9595e86978f15a9822add7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 95KB - Virtual size: 94KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 392B

.rsrc Size: 201KB - Virtual size: 200KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 95KB - Virtual size: 94KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 392B

.rsrc
Size: 201KB - Virtual size: 200KB

.reloc
Size: 5KB - Virtual size: 4KB