vulkan-1[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vulkan-1.dll
Size 824KB
Sample260605-2fmlcaew4t
SHA256 f1b625fce96620f74562aea469f1603d89f16793aec6633f324f4747bfd28822
MD5 f9a30cce621db4607e3ef1000de84bc0
SHA1 de82f3efbc455e695d89c887fdbc4ba1996659cc
SHA512 52331c5d548519213095cfed04170dcc0c058e80752e378e46531fa1bec190419819bddc593d0aa4c6b1e94eabbf382b4d4f4a1aaa6116349a6e23e8dde36e42
SSDEEP 24576:A6+1IbO1KuxO8o0MCGs6Z5WiDYsH56g3P0zAk7IlT3:Dqf1g8o0MS6Z5WiDYsH56g3P0zAk7Ilr
TLSH
T139057C36B858C4B5D51E3030A761F273077A951263A848CB2FBCBFE4ABB41D1267D35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

vulkan-1.dll

.dll 824KB

vulkan-1.dll

IMPHASH 0c3e803dd8e326c1278d7872e609b579
SHA256 f1b625fce96620f74562aea469f1603d89f16793aec6633f324f4747bfd28822
MD5 f9a30cce621db4607e3ef1000de84bc0
SHA1 de82f3efbc455e695d89c887fdbc4ba1996659cc
SHA512 52331c5d548519213095cfed04170dcc0c058e80752e378e46531fa1bec190419819bddc593d0aa4c6b1e94eabbf382b4d4f4a1aaa6116349a6e23e8dde36e42
SSDEEP 24576:A6+1IbO1KuxO8o0MCGs6Z5WiDYsH56g3P0zAk7IlT3:Dqf1g8o0MS6Z5WiDYsH56g3P0zAk7Ilr
TLSH
T139057C36B858C4B5D51E3030A761F273077A951263A848CB2FBCBFE4ABB41D1267D35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

51:fd:c8:b1:f0:78:1d:9a:ad:6c:35:7c:36:ae:83:7b:32:cf:fa:6b:64:9c:ed:47:14:fa:08:60:d3:c7:2f:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 29, 2024

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0b:be:02:c8:83:8f:bf:02:ab:56:ed:ab:b1:e3:4c:19

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2021 - Oct 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

352800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\src\out\Default\vulkan-1.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesExW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA

cfgmgr32

CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key

vkAcquireNextImage2KHR vkAcquireNextImageKHR vkAllocateCommandBuffers vkAllocateDescriptorSets vkAllocateMemory vkBeginCommandBuffer vkBindBufferMemory vkBindBufferMemory2 vkBindImageMemory vkBindImageMemory2 vkCmdBeginQuery vkCmdBeginRenderPass vkCmdBeginRenderPass2 vkCmdBeginRendering vkCmdBindDescriptorSets vkCmdBindIndexBuffer vkCmdBindPipeline vkCmdBindVertexBuffers vkCmdBindVertexBuffers2 vkCmdBlitImage vkCmdBlitImage2 vkCmdClearAttachments vkCmdClearColorImage vkCmdClearDepthStencilImage vkCmdCopyBuffer vkCmdCopyBuffer2 vkCmdCopyBufferToImage vkCmdCopyBufferToImage2 vkCmdCopyImage vkCmdCopyImage2 vkCmdCopyImageToBuffer vkCmdCopyImageToBuffer2 vkCmdCopyQueryPoolResults vkCmdDispatch vkCmdDispatchBase vkCmdDispatchIndirect vkCmdDraw vkCmdDrawIndexed vkCmdDrawIndexedIndirect vkCmdDrawIndexedIndirectCount vkCmdDrawIndirect vkCmdDrawIndirectCount vkCmdEndQuery vkCmdEndRenderPass vkCmdEndRenderPass2 vkCmdEndRendering vkCmdExecuteCommands vkCmdFillBuffer vkCmdNextSubpass vkCmdNextSubpass2 vkCmdPipelineBarrier vkCmdPipelineBarrier2 vkCmdPushConstants vkCmdResetEvent vkCmdResetEvent2 vkCmdResetQueryPool vkCmdResolveImage vkCmdResolveImage2 vkCmdSetBlendConstants vkCmdSetCullMode vkCmdSetDepthBias vkCmdSetDepthBiasEnable vkCmdSetDepthBounds vkCmdSetDepthBoundsTestEnable vkCmdSetDepthCompareOp vkCmdSetDepthTestEnable vkCmdSetDepthWriteEnable vkCmdSetDeviceMask vkCmdSetEvent vkCmdSetEvent2 vkCmdSetFrontFace vkCmdSetLineWidth vkCmdSetPrimitiveRestartEnable vkCmdSetPrimitiveTopology vkCmdSetRasterizerDiscardEnable vkCmdSetScissor vkCmdSetScissorWithCount vkCmdSetStencilCompareMask vkCmdSetStencilOp vkCmdSetStencilReference vkCmdSetStencilTestEnable vkCmdSetStencilWriteMask vkCmdSetViewport vkCmdSetViewportWithCount vkCmdUpdateBuffer vkCmdWaitEvents vkCmdWaitEvents2 vkCmdWriteTimestamp vkCmdWriteTimestamp2 vkCreateBuffer vkCreateBufferView vkCreateCommandPool vkCreateComputePipelines vkCreateDescriptorPool vkCreateDescriptorSetLayout vkCreateDescriptorUpdateTemplate vkCreateDevice vkCreateDisplayModeKHR vkCreateDisplayPlaneSurfaceKHR vkCreateEvent vkCreateFence vkCreateFramebuffer vkCreateGraphicsPipelines vkCreateHeadlessSurfaceEXT vkCreateImage vkCreateImageView vkCreateInstance vkCreatePipelineCache vkCreatePipelineLayout vkCreatePrivateDataSlot vkCreateQueryPool vkCreateRenderPass vkCreateRenderPass2 vkCreateSampler vkCreateSamplerYcbcrConversion vkCreateSemaphore vkCreateShaderModule vkCreateSharedSwapchainsKHR vkCreateSwapchainKHR vkCreateWin32SurfaceKHR vkDestroyBuffer vkDestroyBufferView vkDestroyCommandPool vkDestroyDescriptorPool vkDestroyDescriptorSetLayout vkDestroyDescriptorUpdateTemplate vkDestroyDevice vkDestroyEvent vkDestroyFence vkDestroyFramebuffer vkDestroyImage vkDestroyImageView vkDestroyInstance vkDestroyPipeline vkDestroyPipelineCache vkDestroyPipelineLayout vkDestroyPrivateDataSlot vkDestroyQueryPool vkDestroyRenderPass vkDestroySampler vkDestroySamplerYcbcrConversion vkDestroySemaphore vkDestroyShaderModule vkDestroySurfaceKHR vkDestroySwapchainKHR vkDeviceWaitIdle vkEndCommandBuffer vkEnumerateDeviceExtensionProperties vkEnumerateDeviceLayerProperties vkEnumerateInstanceExtensionProperties vkEnumerateInstanceLayerProperties vkEnumerateInstanceVersion vkEnumeratePhysicalDeviceGroups vkEnumeratePhysicalDevices vkFlushMappedMemoryRanges vkFreeCommandBuffers vkFreeDescriptorSets vkFreeMemory vkGetBufferDeviceAddress vkGetBufferMemoryRequirements vkGetBufferMemoryRequirements2 vkGetBufferOpaqueCaptureAddress vkGetDescriptorSetLayoutSupport vkGetDeviceBufferMemoryRequirements vkGetDeviceGroupPeerMemoryFeatures vkGetDeviceGroupPresentCapabilitiesKHR vkGetDeviceGroupSurfacePresentModesKHR vkGetDeviceImageMemoryRequirements vkGetDeviceImageSparseMemoryRequirements vkGetDeviceMemoryCommitment vkGetDeviceMemoryOpaqueCaptureAddress vkGetDeviceProcAddr vkGetDeviceQueue vkGetDeviceQueue2 vkGetDisplayModeProperties2KHR vkGetDisplayModePropertiesKHR vkGetDisplayPlaneCapabilities2KHR vkGetDisplayPlaneCapabilitiesKHR vkGetDisplayPlaneSupportedDisplaysKHR vkGetEventStatus vkGetFenceStatus vkGetImageMemoryRequirements vkGetImageMemoryRequirements2 vkGetImageSparseMemoryRequirements vkGetImageSparseMemoryRequirements2 vkGetImageSubresourceLayout vkGetInstanceProcAddr vkGetPhysicalDeviceDisplayPlaneProperties2KHR vkGetPhysicalDeviceDisplayPlanePropertiesKHR vkGetPhysicalDeviceDisplayProperties2KHR vkGetPhysicalDeviceDisplayPropertiesKHR vkGetPhysicalDeviceExternalBufferProperties vkGetPhysicalDeviceExternalFenceProperties vkGetPhysicalDeviceExternalSemaphoreProperties vkGetPhysicalDeviceFeatures vkGetPhysicalDeviceFeatures2 vkGetPhysicalDeviceFormatProperties vkGetPhysicalDeviceFormatProperties2 vkGetPhysicalDeviceImageFormatProperties vkGetPhysicalDeviceImageFormatProperties2 vkGetPhysicalDeviceMemoryProperties vkGetPhysicalDeviceMemoryProperties2 vkGetPhysicalDevicePresentRectanglesKHR vkGetPhysicalDeviceProperties vkGetPhysicalDeviceProperties2 vkGetPhysicalDeviceQueueFamilyProperties vkGetPhysicalDeviceQueueFamilyProperties2 vkGetPhysicalDeviceSparseImageFormatProperties vkGetPhysicalDeviceSparseImageFormatProperties2 vkGetPhysicalDeviceSurfaceCapabilities2KHR vkGetPhysicalDeviceSurfaceCapabilitiesKHR vkGetPhysicalDeviceSurfaceFormats2KHR vkGetPhysicalDeviceSurfaceFormatsKHR vkGetPhysicalDeviceSurfacePresentModesKHR vkGetPhysicalDeviceSurfaceSupportKHR vkGetPhysicalDeviceToolProperties vkGetPhysicalDeviceWin32PresentationSupportKHR vkGetPipelineCacheData vkGetPrivateData vkGetQueryPoolResults vkGetRenderAreaGranularity vkGetSemaphoreCounterValue vkGetSwapchainImagesKHR vkInvalidateMappedMemoryRanges vkMapMemory vkMergePipelineCaches vkQueueBindSparse vkQueuePresentKHR vkQueueSubmit vkQueueSubmit2 vkQueueWaitIdle vkResetCommandBuffer vkResetCommandPool vkResetDescriptorPool vkResetEvent vkResetFences vkResetQueryPool vkSetEvent vkSetPrivateData vkSignalSemaphore vkTrimCommandPool vkUnmapMemory vkUpdateDescriptorSetWithTemplate vkUpdateDescriptorSets vkWaitForFences vkWaitSemaphores

Name

.text

Size

546KB

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vulkan-1.dll

kernel32

advapi32

cfgmgr32

generic