RzChromaSDK64[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
RzChromaSDK64.dll
Size 1.4MB
Sample260703-mtltmsfw2z
SHA256 41eb71920c7047c374820873feffcaabd517d41f4183e856d5dfa662b3058ff0
MD5 49a985a1d9496ce36a8aa12d959adeb2
SHA1 ea700fb61f9613ec95e53b1b7dac93274c429352
SHA512 bfd95141b7b066de538a6f953e1454444f04ba7b51f6b3dd003bba419dcfafab1df60c73a3e427d3e1848dca4a94f80a89480aefcfd8dde5589173f7d7916b13
SSDEEP 24576:h5v7yW4Re0ta96seSYZf425laW4DtT9KxjCOtiynt9rY:tqev9ZeSYyqlD0T4xjChyn
TLSH
T1F4656C46E2E806F1D06AD535C433590ECAB17A1403328ADBBEF42D496F73BD1937AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RzChromaSDK64.dll

File Explorer

RzChromaSDK64.dll

.dll 1.4MB

RzChromaSDK64.dll

IMPHASH a8f19242ea7febaa7d55322ef4a2f8e3
SHA256 41eb71920c7047c374820873feffcaabd517d41f4183e856d5dfa662b3058ff0
MD5 49a985a1d9496ce36a8aa12d959adeb2
SHA1 ea700fb61f9613ec95e53b1b7dac93274c429352
SHA512 bfd95141b7b066de538a6f953e1454444f04ba7b51f6b3dd003bba419dcfafab1df60c73a3e427d3e1848dca4a94f80a89480aefcfd8dde5589173f7d7916b13
SSDEEP 24576:h5v7yW4Re0ta96seSYZf425laW4DtT9KxjCOtiynt9rY:tqev9ZeSYyqlD0T4xjChyn
TLSH
T1F4656C46E2E806F1D06AD535C433590ECAB17A1403328ADBBEF42D496F73BD1937AB16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

574336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\uknow\Desktop\ritz-amazing-fortnite-internal-main\x64\Release\ritz.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetCurrentProcessId WideCharToMultiByte GetTickCount GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage LoadLibraryA FindFirstFileExW FindClose HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers HeapAlloc HeapFree GetFileType GetStdHandle GetTempPathA GetModuleHandleA GetModuleFileNameW VirtualAlloc SetFilePointerEx GetFileSizeEx ExitProcess OutputDebugStringA GetModuleHandleExW VirtualFree VirtualProtect FindNextFileW ReadFile LoadLibraryExW TlsFree TlsSetValue GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx RtlUnwind GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList GetLastError SetLastError TlsAlloc TlsGetValue

user32

UnregisterClassA CreateWindowExA RegisterClassExA GetCursorPos EnumWindows GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW CallWindowProcW GetWindow DestroyWindow IsWindowVisible SetWindowLongPtrW ScreenToClient IsWindow DefWindowProcA

shell32

ShellExecuteW

urlmon

URLDownloadToFileA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

785KB

Virtual Size

785KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

580KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RzChromaSDK64.dll

d3d11

kernel32

user32

shell32

urlmon

imm32

d3dcompiler_47

generic