C:\dvs\p4\build\sw\rel\gfclient\rel_03_28\shadowplay2\FrameProvider\FrameProviderDLL\win7_amd64_release\nvfp64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
wme.dll
Resource
win10v2004-20241007-en
General
-
Target
wme.zip
-
Size
643KB
-
MD5
733fff1d917e41379b5a0367a25ab0f3
-
SHA1
3b15172233f01a5e7866a5ef12a55192d079efa8
-
SHA256
b59a84b168f1524bdd0f0dad450b042e861bba7e90d91514678fdf557ca64356
-
SHA512
26b49cdde80dce8f43b181020711289468bc14edec4fe9387d29420894bcbf4b16984c599aed0d0c8b64a053ffe459887a2489fb26dee676349ca2e9eaf331ae
-
SSDEEP
12288:cSNbUy2PaSpnbBcOGQhcYAiB3RfnA1cbRs91hPrA9j0nqHniWqUxwRMGa:cSqy2vbBc4hWafnAC1QhA9tiwia
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/wme.dll
Files
-
wme.zip.zip
Password: infected
-
wme.dll.dll windows:6 windows x64 arch:x64
Password: infected
a7d5ffec96e44893df1838b9513af597
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
shell32
SHGetFolderPathA
kernel32
GetCurrentThreadId
GetLocalTime
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalAlloc
LocalFree
CopyFileA
MoveFileExA
WideCharToMultiByte
SetEnvironmentVariableA
GetCurrentProcess
GetSystemDirectoryW
FreeLibrary
GetModuleHandleA
VirtualAlloc
GetCurrentThread
FormatMessageA
QueryPerformanceFrequency
Sleep
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
SetLastError
CreateProcessA
CreateProcessW
GetModuleFileNameA
LoadLibraryExW
VerifyVersionInfoW
OutputDebugStringW
ReadConsoleW
ReadFile
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
CloseHandle
OutputDebugStringA
WriteFile
GetFinalPathNameByHandleA
GetFileSizeEx
GetFileAttributesA
DeleteFileA
CreateFileA
CreateDirectoryA
WriteConsoleW
VirtualFree
CreateEventW
FormatMessageW
InitializeCriticalSectionAndSpinCount
RtlUnwind
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
user32
wsprintfA
advapi32
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameW
GetUserNameA
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateSelf
GetSecurityDescriptorDacl
FreeSid
CreateWellKnownSid
CreateRestrictedToken
AllocateAndInitializeSid
OpenThreadToken
SetThreadToken
Exports
Exports
FrameProviderCreateInterface
Sections
.text Size: 936KB - Virtual size: 935KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 437B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 245KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ