capcore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

capcore.dll
Size

1.6MB
MD5

f6c4b1df1349584c44becbb89a034344
SHA1

c1c9eb05537944858d127b111fd59ce80cd2e5d0
SHA256

41a51f0040973696adc83ebcfdeeb5b3b43465f28d6911086ace510a0358104f
SHA512

7e288260fab995e8ff86f172762b6e88becc402980492405828dc25d45742b47fc32e4826777ed0e07e768bd1ce3cf272f89bc139230979283351791d04a9259
SSDEEP

49152:swdHshYyNCRTzFpp7ojo1iucuox7aepB9BKP+5QdgDO4EbMVFOQjtmgK1QhZVOV5:vhy8Nz/uP+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
capcore.dll

Files

capcore.dll
.dll windows:6 windows x64 arch:x64

e82487cc00471cd21c0c82b671255186

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gfclient\rel_03_28\shadowplay2\capcore\win7_amd64_release\capcore64.pdb

Imports

shell32

SHGetFolderPathW
SHGetKnownFolderPath

ole32

CoInitializeEx
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoUninitialize

kernel32

GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
VerifyVersionInfoW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
CreateSemaphoreW
GetCurrentProcess
SetThreadPriority
GetThreadPriority
SetPriorityClass
GetPriorityClass
SleepEx
SetWaitableTimer
CancelWaitableTimer
Sleep
CreateWaitableTimerW
CreateEventExW
GetVolumeInformationA
OutputDebugStringW
GetVersionExW
CreateDirectoryW
DeleteFileW
GetModuleHandleW
CreateProcessW
WriteFile
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLocalTime
CopyFileW
MoveFileExW
WideCharToMultiByte
GetDiskFreeSpaceExW
GetTempFileNameW
ReadFile
SetFilePointer
FlushFileBuffers
GetTickCount
ResetEvent
CreateThread
GetThreadId
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleFileNameA
FreeLibrary
GetFileSizeEx
GetSystemDirectoryW
CreateProcessA
SetLastError
GetLastError
RtlUnwind
CloseHandle
GetFullPathNameW
GetFileAttributesW
CreateFileW
VerSetConditionMask
GetStringTypeW
SetFilePointerEx
SetStdHandle
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
ReadConsoleW
GetFinalPathNameByHandleW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetConsoleCtrlHandler
HeapAlloc
HeapFree
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

user32

DrawTextW
InvalidateRect
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
EnumDisplayDevicesW
PostThreadMessageW

gdi32

SetBkMode
SetDCPenColor
SetDCBrushColor
SetTextColor

advapi32

CreateRestrictedToken
SetEntriesInAclW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameW
GetUserNameA
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateSelf
GetSecurityDescriptorDacl
FreeSid
CreateWellKnownSid
AllocateAndInitializeSid
OpenThreadToken
SetThreadToken

winmm

timeBeginPeriod
timeEndPeriod

oleaut32

VariantInit
VariantClear

shlwapi

PathAppendW
PathIsUNCW

Exports

Exports

DxStBoot

Sections

.text
Size: 893KB - Virtual size: 893KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 437B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e82487cc00471cd21c0c82b671255186

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

ole32

kernel32

user32

gdi32

advapi32

winmm

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 893KB - Virtual size: 893KB

.rdata Size: 321KB - Virtual size: 321KB

.data Size: 19KB - Virtual size: 45KB

.pdata Size: 43KB - Virtual size: 42KB

.idata Size: 10KB - Virtual size: 9KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 283B

_RDATA Size: 512B - Virtual size: 437B

.rsrc Size: 361KB - Virtual size: 360KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 893KB - Virtual size: 893KB

.rdata
Size: 321KB - Virtual size: 321KB

.data
Size: 19KB - Virtual size: 45KB

.pdata
Size: 43KB - Virtual size: 42KB

.idata
Size: 10KB - Virtual size: 9KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 283B

_RDATA
Size: 512B - Virtual size: 437B

.rsrc
Size: 361KB - Virtual size: 360KB

.reloc
Size: 7KB - Virtual size: 6KB