e07ed915dfe8e164c1f132c29f5b31feaa1bf7a66127c9f205cd50b819ca23fb

Sharing

Copy URL Twitter E-mail

General

Target

e07ed915dfe8e164c1f132c29f5b31feaa1bf7a66127c9f205cd50b819ca23fb
Size

802KB
MD5

7bcdf78352d229ad40b61a8291604d1a
SHA1

c2ec45503a5d0d9794c3bf08a3bacdbf5f966df5
SHA256

e07ed915dfe8e164c1f132c29f5b31feaa1bf7a66127c9f205cd50b819ca23fb
SHA512

6dc831d2016fbe0dbaa8b62e8593c8e195f34fdd9736bf76ec3e9a85d2ae95318eb958f76374de0f0e4d9448a41eb848667c38157ec1286a7a607f9cd373ade3
SSDEEP

12288:GdqHL44YUoGf+bwSMBW807psFcCPFiyVuOqu0Wp:FHLVYUoGf8wJBWb7psdPiu0s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e07ed915dfe8e164c1f132c29f5b31feaa1bf7a66127c9f205cd50b819ca23fb

Files

e07ed915dfe8e164c1f132c29f5b31feaa1bf7a66127c9f205cd50b819ca23fb
.dll windows:10 windows x86 arch:x86

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rdvgogl32.pdb

Imports

msvcrt

islower
calloc
isupper
__pctype_func
abort
??1type_info@@UAE@XZ
__CxxFrameHandler3
?terminate@@YAXXZ
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
_wcsdup
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
localeconv
??0bad_cast@@QAE@PBD@Z
_onexit
__dllonexit
strcspn
ldexp
realloc
_initterm
_amsg_exit
_XcptFilter
_unlock
isdigit
_lock
_Getdays
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
memset
_Strftime
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@XZ
_callnewh
sscanf_s
_aligned_malloc
_aligned_free
_vsnwprintf
??_V@YAXPAX@Z
strtok_s
sprintf_s
malloc
free
__mb_cur_max
_Gettnames
_Wcsftime
??0exception@@QAE@ABQBD@Z
_ftol2_sse
_ftol2
_CIsin
setlocale
_except_handler4_common
_W_Gettnames
_W_Getmonths
_W_Getdays
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
??3@YAXPAX@Z
_Getmonths
_CIcos
ceil

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

user32

UnhookWindowsHookEx
SetPropW
AdjustWindowRect
GetWindowInfo
GetClientRect
CallNextHookEx
ReleaseDC
GetDC
MessageBoxW
LoadStringW
WindowFromDC
EnumDisplayDevicesW
SetWindowsHookExW

kernel32

GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetCurrentProcessId
InitializeCriticalSectionEx
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetModuleFileNameW
SetUnhandledExceptionFilter
GetLocaleInfoW
GetSystemInfo
TlsSetValue
GetWriteWatch
ResetWriteWatch
GetCurrentThreadId
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
TlsAlloc
TlsFree
GetLastError
GetModuleHandleW
GetProcAddress
ResolveDelayLoadedAPI
DelayLoadFailureHook
TlsGetValue
VirtualAlloc

gdi32

SetPixelFormat
DeleteDC
CreateCompatibleDC
ChoosePixelFormat
CreateDCW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlIsCriticalSectionLockedByThread

d3d11

D3D11CreateDevice

opengl32

glGetTexLevelParameteriv
wglCreateContext

glu32

gluErrorString

rfxvmt

RfxVmtCloseChannel
RfxVmtReadChannel
RfxVmtWriteChannel
RfxVmtGetDataAvailableEvent
RfxVmtCreateChannel

Exports

Exports

DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvSwapMultipleBuffers
DrvValidateVersion

Sections

.text
Size: 623KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

user32

kernel32

gdi32

version

ntdll

d3d11

opengl32

glu32

rfxvmt

Exports

Exports

Sections

.text Size: 623KB - Virtual size: 622KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 169KB - Virtual size: 169KB

.text
Size: 623KB - Virtual size: 622KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 169KB - Virtual size: 169KB