example_win32_directx11[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
example_win32_directx11.exe
Size 4.4MB
Sample260716-raqqpsax9x
SHA256 c0fb3d2eb1b1e774f5c8f49f535124414b96b2b7c516d58f844a5694082bc0f9
MD5 fd739a37a69f1881c54e4115320e0455
SHA1 55f44800653f930761e3b2820efc69d3ac7c529f
SHA512 45912b3447a0b18802184820f877baa943c9776ece996c08a85da84ce4ea1269c4f24859181ce2852ffef1ba643d77b91f1ce2a7fb16225a0c87f633a3f07cd7
SSDEEP 49152:1cSB0sNETU0wR+azV7inwaplWmSUDDrN84NOEFDsIHLDJjQa+ZPX3v3thzbzV9a2:IxTFwZQplGUjNAEyo8ZPX3v3thX5o2
TLSH
T16B260207F3E602ECD1278638C6669727E37578151B309ACB27D00AA6AF636E05F7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
example_win32_directx11.exe

File Explorer

example_win32_directx11.exe

.exe 4.4MB

example_win32_directx11.exe

IMPHASH 255ff1ebc076452afbdba92d888200ef
SHA256 c0fb3d2eb1b1e774f5c8f49f535124414b96b2b7c516d58f844a5694082bc0f9
MD5 fd739a37a69f1881c54e4115320e0455
SHA1 55f44800653f930761e3b2820efc69d3ac7c529f
SHA512 45912b3447a0b18802184820f877baa943c9776ece996c08a85da84ce4ea1269c4f24859181ce2852ffef1ba643d77b91f1ce2a7fb16225a0c87f633a3f07cd7
SSDEEP 49152:1cSB0sNETU0wR+azV7inwaplWmSUDDrN84NOEFDsIHLDJjQa+ZPX3v3thzbzV9a2:IxTFwZQplGUjNAEyo8ZPX3v3thX5o2
TLSH
T16B260207F3E602ECD1278638C6669727E37578151B309ACB27D00AA6AF636E05F7B711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

998896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\whatsadma\Desktop\newvolkloader\thirdparty\imgui\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

dxgi

CreateDXGIFactory1

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptDecrypt BCryptExportKey BCryptGenRandom BCryptVerifySignature BCryptKeyDerivation BCryptDestroyKey BCryptEncrypt BCryptFinalizeKeyPair BCryptFinishHash BCryptGetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptSignHash BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider

winhttp

WinHttpConnect WinHttpQueryOption WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpSetOption WinHttpReceiveResponse WinHttpCrackUrl WinHttpQueryDataAvailable

kernel32

RtlVirtualUnwind RtlCaptureContext FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetFileType LoadLibraryA GetProcAddress FreeLibrary CreateDirectoryW GetVolumeInformationW HeapFree GetPhysicallyInstalledSystemMemory VirtualFree WriteFile VirtualAlloc CreateFileW GetFileAttributesW GetCurrentThreadId GetSystemDirectoryW GetModuleHandleA MultiByteToWideChar GetTempPathA CreateFileA GetDiskFreeSpaceExW DeleteFileW CloseHandle LoadLibraryW HeapAlloc GetLocalTime LocalFree ExitProcess GetProcessHeap GetModuleHandleW WideCharToMultiByte FlushFileBuffers GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter K32EnumDeviceDrivers GetSystemFirmwareTable ReadFile RemoveVectoredExceptionHandler GetFileSizeEx VirtualProtect SetLastError GetCommandLineW GetCurrentProcess OutputDebugStringA TerminateProcess GetModuleFileNameW Thread32Next GetTempPathW K32GetDeviceDriverBaseNameA Thread32First K32EmptyWorkingSet UnhandledExceptionFilter FindClose ResumeThread CreateToolhelp32Snapshot Sleep OpenMutexA GetCurrentThread AddVectoredExceptionHandler GetThreadContext IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime EnumSystemFirmwareTables VirtualQuery OpenThread CheckRemoteDebuggerPresent SetFilePointerEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCPInfo GetStringTypeW RtlLookupFunctionEntry DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapReAlloc RtlUnwindEx RtlPcToFileHeader RaiseException IsDebuggerPresent OutputDebugStringW SuspendThread LCMapStringW GetConsoleMode ReadConsoleW FlsAlloc FlsGetValue FlsSetValue GetStdHandle LoadLibraryExW GetLastError FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetLogicalProcessorInformationEx GetConsoleOutputCP HeapSize K32QueryWorkingSetEx SetEndOfFile FlsFree RtlUnwind

user32

DispatchMessageA DestroyWindow IsWindowVisible CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow EnumWindows SetLayeredWindowAttributes TranslateMessage GetClassNameW PeekMessageA UpdateWindow GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture DefWindowProcW TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxW wsprintfA GetAsyncKeyState MessageBoxA EnumDisplayDevicesW PostQuitMessage SetForegroundWindow GetWindowRect MoveWindow ClientToScreen EnableWindow

advapi32

SystemFunction036 LookupPrivilegeValueW AdjustTokenPrivileges RegGetValueA OpenProcessToken RegEnumKeyExA RegCloseKey RegQueryValueExA RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteExW SHGetKnownFolderPath

ole32

CoTaskMemFree

d3dx11_43

D3DX11CreateShaderResourceViewFromFileW D3DX11CreateShaderResourceViewFromMemory

crypt32

CryptHashPublicKeyInfo CryptDecodeObjectEx CertFreeCertificateContext CryptImportPublicKeyInfoEx2 CryptUnprotectData CryptProtectData

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

362KB

Virtual Size

361KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

example_win32_directx11.exe

d3d11

d3dcompiler_43

dxgi

bcrypt

winhttp

kernel32

user32

advapi32

shell32

ole32

d3dx11_43

crypt32

imm32

dwmapi

generic