dxgi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dxgi.dll
Size

334KB
MD5

b30b1dc411c38612d8e71c8197a43663
SHA1

ee9cdb33714ad2913b4c1e73a59e65155a7f79c0
SHA256

39ba8789a0610512ce137237062417c9259b45e8a753625123dd06e1b0ff1bb2
SHA512

c19cbaf29e271f31c23942e84f3c706ccecaf37498cb92cc9e55a161f3264911127e49abee3a89ad20bc0cc1dba278cab446c355f9e728759b462333e6249137
SSDEEP

3072:8CfEAVZ6dkWJD0EQ1dq0R24RiZPsvfKavZP/G+WOme2uxeeax3wZPrJGcp3uD37P:tEqZLWmTq0R0l3wZl3Ao6+V+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dxgi.dll

Files

dxgi.dll
.dll windows:6 windows x64 arch:x64

c140e74b17990a88a979145e6ebb0ef0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Folders\Games\d3d12-proxy\x64\Release\dxgi.pdb

Imports

kernel32

GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcess
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId

vcruntime140

_CxxThrowException
__std_exception_copy
memset
__C_specific_handler
__std_exception_destroy
__std_type_info_destroy_list
memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_seh_filter_dll
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_execute_onexit_table

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

Exports

Exports

CreateDXGIFactory
CreateDXGIFactory1
CreateDXGIFactory2
DXGIDeclareAdapterRemovalSupport
DXGIGetDebugInterface1

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c140e74b17990a88a979145e6ebb0ef0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 316KB - Virtual size: 316KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 816B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 316KB - Virtual size: 316KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 816B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 4KB - Virtual size: 4KB