F*fCS57o%4nixuEX~U"`q+3{dp[O-aN2e+!:DOlQ';EY/@U]ATPH0J)L&]U4Iu>F85s9Oj!CJO<i\XYN%wj2>z{/vb2,{7]"4{yvb@c>+TJq_(hk
Static task
static1
Behavioral task
behavioral1
Sample
RzChromaSDK64.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
RzChromaSDK64.dll
Resource
win10v2004-20240611-en
General
-
Target
RzChromaSDK64.dll
-
Size
2.1MB
-
MD5
e6b1e424b7a297ece4d62bc33560e914
-
SHA1
dfefe923d24d54c1197c54323e55f9053aacc7fe
-
SHA256
585713486edd9cf1d1b0b6d689957ade28575bb9b20ab107b2a6aa9d0b64d1f2
-
SHA512
fb861014e580e170c01916668e4e83dc2a75d2011d8c046b9311655ac51d974512a31cc86b8c9b56d7d8f4c700d7dec739fb44b1d4ae0dedda7025d0f6969f4e
-
SSDEEP
49152:Bd9uwVXL1TnURIbwWpo/P7wjgTm0PxAwJHE6hd:/91p1Tho/P7mgTm05AwJHE6h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RzChromaSDK64.dll
Files
-
RzChromaSDK64.dll.dll windows:6 windows x64 arch:x64
44494e5f10660ac4a29b8f3e6a5b20d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
HeapSize
CreateFileW
SetStdHandle
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
OutputDebugStringW
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
Thread32First
Thread32Next
GetCurrentProcess
HeapFree
VirtualProtect
HeapCreate
VirtualQuery
VirtualAlloc
GetSystemInfo
VirtualFree
LCMapStringW
FlsFree
FlsSetValue
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
FlsAlloc
FlsGetValue
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetWindowLongPtrW
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
Sections
.text Size: 872KB - Virtual size: 871KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1017KB - Virtual size: 1023KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ