D:\Apps\staticaddress\Spartacus-v2.2.2-x64\solution\DWrite\Release\DWrite.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DWrite.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
DWrite.dll
Resource
win11-20240802-en
General
-
Target
DWrite.dll
-
Size
599KB
-
MD5
e3f02de32b19df9cd54de178d6c05da3
-
SHA1
7bf77907dd35bbdf00abde1b18751812fc2831d2
-
SHA256
b0ec420c040bde44979cfe938f13ec502f234e8a2c09272cd374d2b59797b9cb
-
SHA512
d0ed86e9981040d321d24dfb4ef42e1208b161c359750e33d06a7d1af3335b2969d8fa137ae6be7950d1c339734f7099106f6a1ced7bbd47da83db6d5cdd4273
-
SSDEEP
12288:lbGJC7jI91MX4p51wlI9d5TtwCuFxx4ksz8mDQp/Opg4fYbksOsm:lbGJC7891jpLxTtwCung8rxdpOd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DWrite.dll
Files
-
DWrite.dll.dll windows:6 windows x86 arch:x86
323032a121c85cfe86c1cd296bdd97b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
K32EnumProcessModules
CreateThread
LoadLibraryW
K32GetModuleBaseNameW
OpenProcess
MultiByteToWideChar
IsBadReadPtr
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetModuleFileNameW
SetEvent
WaitForSingleObject
CreateEventW
QueryPerformanceFrequency
GetSystemDirectoryW
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
Sleep
WideCharToMultiByte
SetLastError
FormatMessageW
MoveFileExW
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
lstrlenW
ReadFile
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
PeekNamedPipe
WriteFile
DeleteCriticalSection
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
msvcp140
?good@ios_base@std@@QBE_NXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
_Cnd_init_in_situ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
_Cnd_timedwait
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Xtime_get_ticks
_Mtx_unlock
_Cnd_broadcast
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?uncaught_exceptions@std@@YAHXZ
??Bios_base@std@@QBE_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
bcrypt
BCryptGenRandom
vcruntime140
memcpy
strrchr
memchr
memmove
__CxxFrameHandler3
strstr
wcschr
_CxxThrowException
strchr
__std_terminate
__std_exception_destroy
memset
_except_handler4_common
__std_type_info_destroy_list
__std_exception_copy
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
strftime
api-ms-win-crt-stdio-l1-1-0
_read
_write
_fileno
__acrt_iob_func
_fseeki64
__stdio_common_vfprintf
_lseeki64
__stdio_common_vswprintf
fseek
__stdio_common_vsprintf
fgets
_close
fread
_wfopen
fflush
fputc
__stdio_common_vsscanf
fwrite
fclose
ftell
_wopen
feof
fputs
api-ms-win-crt-heap-l1-1-0
realloc
calloc
malloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
terminate
_invalid_parameter_noinfo_noreturn
_errno
__sys_errlist
__sys_nerr
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
wcstombs
wcstombs_s
strtod
strtol
strtoll
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
wcspbrk
strncmp
strcspn
strspn
wcsncpy
_wcsdup
strpbrk
wcsncmp
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_wstat64
_unlink
api-ms-win-crt-math-l1-1-0
_dclass
_fdopen
ws2_32
listen
recv
getaddrinfo
recvfrom
sendto
htonl
getpeername
ioctlsocket
gethostname
getsockname
freeaddrinfo
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSASetLastError
connect
inet_pton
ntohs
inet_ntop
WSAStartup
WSACleanup
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
WSAGetLastError
crypt32
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryW
PFXImportCertStore
CryptQueryObject
CertCloseStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertCreateCertificateChainEngine
CertOpenStore
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
Exports
Exports
DWriteCreateFactory
Sections
.text Size: 470KB - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ