C:\Users\laz\Desktop\Aqua-rework-Free-ImGui-Loader-master\x64\Release\dxdiag.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dxdiag.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dxdiag.exe
Resource
win10-20240611-en
General
-
Target
dxdiag.exe
-
Size
1.6MB
-
MD5
3dd82024db6caf66927450e5912a374c
-
SHA1
7cde23bafbeb2f02a903176d0bc7cb004c88382e
-
SHA256
3bea1a7d567aa8cd67b5515379dcf0c240a915f20104d68e001e4025a916058b
-
SHA512
e305af39973745a87c969b97f2f3a6e07cb62c7c7156b1bef2e28e6c582e44df99199c16faf85c06adb7d9fd812a85f04ec3feb7e9eadc512bf345a960860117
-
SSDEEP
24576:6Kq3PLh9yFURCZf0b8QoRGs8Ucvl1gnsIERP9aagTlb/PmUIgi7y0:jqV8HywNRGsS9insHapl75f0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dxdiag.exe
Files
-
dxdiag.exe.exe windows:6 windows x64 arch:x64
84ad6c90e9c85c1bfbe07bc4df3bd269
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
ResetEvent
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
QueryFullProcessImageNameW
GetModuleFileNameW
GetModuleFileNameA
UnmapViewOfFile
WaitForSingleObjectEx
AreFileApisANSI
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
CreateFileW
VirtualQueryEx
GetTickCount
GetConsoleWindow
GetModuleHandleW
GetProcessHeap
ReadProcessMemory
DeleteCriticalSection
MoveFileExA
HeapAlloc
GetSystemInfo
GetFileAttributesExW
CloseHandle
HeapReAlloc
Process32FirstW
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
HeapSize
OpenProcess
InitializeCriticalSectionEx
TerminateProcess
GetCurrentProcess
HeapFree
WriteProcessMemory
LoadLibraryW
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetLocaleInfoA
CreateEventW
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
RtlCaptureContext
CreateDirectoryW
GetCurrentDirectoryW
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
HeapDestroy
LeaveCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringW
GetFileInformationByHandleEx
SetEvent
IsDebuggerPresent
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
user32
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
SetWindowLongA
PeekMessageW
MessageBoxA
SetLayeredWindowAttributes
TranslateMessage
PostQuitMessage
UpdateWindow
GetWindowRect
MoveWindow
GetKeyState
DefWindowProcW
GetWindowLongW
GetMessageExtraInfo
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
DestroyWindow
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ScreenToClient
GetCapture
advapi32
CryptGetHashParam
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerA
shell32
ShellExecuteA
imm32
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
msvcp140
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
urlmon
URLDownloadToFileA
shlwapi
PathFindFileNameW
userenv
UnloadUserProfile
normaliz
IdnToAscii
wldap32
ord301
ord46
ord211
ord30
ord79
ord35
ord60
ord143
ord33
ord32
ord27
ord50
ord26
ord200
ord22
ord217
ord45
ord41
crypt32
CertFreeCertificateChain
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFindExtension
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertGetNameStringA
ws2_32
htons
getsockopt
getsockname
getpeername
connect
ntohs
WSAGetLastError
send
recv
socket
closesocket
bind
WSASetLastError
WSAIoctl
gethostname
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
ntohl
setsockopt
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
strrchr
memset
memmove
memcpy
memcmp
memchr
_CxxThrowException
__std_exception_copy
__std_exception_destroy
strchr
strstr
__std_terminate
api-ms-win-crt-stdio-l1-1-0
feof
fputs
_close
_open
fopen
__stdio_common_vfprintf
ftell
fclose
fwrite
_read
_write
_wfopen
__p__commode
__stdio_common_vsprintf
fread
__acrt_iob_func
__stdio_common_vsscanf
fputc
fflush
_popen
_pclose
fgets
_get_stream_buffer_pointers
_set_fmode
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fgetc
_lseeki64
fseek
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
strcmp
tolower
strspn
towlower
strncpy
strcspn
strncmp
_strdup
strpbrk
isupper
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
malloc
realloc
free
_callnewh
api-ms-win-crt-convert-l1-1-0
atoi
strtoll
strtoull
strtod
strtol
strtoul
api-ms-win-crt-runtime-l1-1-0
exit
_beginthreadex
system
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
_errno
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
strerror
__sys_nerr
_invalid_parameter_noinfo
_getpid
_resetstkoflw
api-ms-win-crt-math-l1-1-0
sinf
_dsign
_dclass
cosf
sqrtf
__setusermatherr
acosf
ceilf
fmodf
api-ms-win-crt-filesystem-l1-1-0
_stat64
_lock_file
_unlink
_unlock_file
_access
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
strftime
_localtime64
_time64
_gmtime64
Sections
.text Size: 731KB - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 696KB - Virtual size: 699KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ