strixgg[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
strixgg.dll
Size 1.9MB
Sample260801-vx7vaascja
SHA256 96f94e9b37a5985ba371bcec43dd4b43c8e3fc18e91b81d3cad004fea566c9c4
MD5 059592be39c99aa09206f6e856c8409f
SHA1 ea39cbf0305cd104f3e467080d55a4f151c32f71
SHA512 312c6227e90a2164d3306430f1e780f0ba1e7b9ed5d59fd2e68fda5d0b5210a103e66cfad80f1736fbf9e6aa31c3b98afa7f9db25fc620fe31a13ea880922d34
SSDEEP 24576:Fot1djdbuttiDNYaj0qTDs+LvJdoP3I9vRoYol8tv3RRUZm+3+Y/Ui9YduxMEwFG:F2djgzag+LvJdMYA3+Y8GGDcLOIp
TLSH
T10795D016F696C267C08206B9DB78FB3321786E25270433D7BBC15C6DA9A14D1BAF170B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
strixgg.dll

File Explorer

strixgg.dll

.dll 1.9MB

strixgg.dll

IMPHASH ab2d14a5e5e48cd00cf98a3754eb56ef
SHA256 96f94e9b37a5985ba371bcec43dd4b43c8e3fc18e91b81d3cad004fea566c9c4
MD5 059592be39c99aa09206f6e856c8409f
SHA1 ea39cbf0305cd104f3e467080d55a4f151c32f71
SHA512 312c6227e90a2164d3306430f1e780f0ba1e7b9ed5d59fd2e68fda5d0b5210a103e66cfad80f1736fbf9e6aa31c3b98afa7f9db25fc620fe31a13ea880922d34
SSDEEP 24576:Fot1djdbuttiDNYaj0qTDs+LvJdoP3I9vRoYol8tv3RRUZm+3+Y/Ui9YduxMEwFG:F2djgzag+LvJdMYA3+Y8GGDcLOIp
TLSH
T10795D016F696C267C08206B9DB78FB3321786E25270433D7BBC15C6DA9A14D1BAF170B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

789214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\hidden project\bin\strixgg.pdb

d3dx9_43

D3DXCreateTextureFromFileInMemory D3DXGetImageInfoFromFileInMemory

kernel32

QueryPerformanceCounter VirtualFree VirtualAlloc VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep HeapReAlloc CloseHandle HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId FlushInstructionCache SetThreadContext OpenThread SetConsoleTextAttribute GetStdHandle AllocConsole DisableThreadLibraryCalls CreateThread ExitProcess GetLastError GetSystemDirectoryA K32GetModuleInformation CreateFileA QueryPerformanceFrequency ReadFile MapViewOfFile UnmapViewOfFile CreateFileMappingA AreFileApisANSI LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar IsProcessorFeaturePresent WakeAllConditionVariable GetProcAddress GetCurrentDirectoryW GetFileSizeEx InitializeSListHead SleepConditionVariableSRW GetSystemTimeAsFileTime

user32

LoadCursorA GetMessageExtraInfo GetKeyState GetAsyncKeyState SendInput ScreenToClient GetCapture SetWindowLongW ClientToScreen CallWindowProcA GetKeyNameTextA TrackMouseEvent GetForegroundWindow SetCapture MapVirtualKeyA SetCursor GetClientRect SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ _Query_perf_frequency ?uncaught_exceptions@std@@YAHXZ _Query_perf_counter ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?good@ios_base@std@@QBE_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

vcruntime140

_except_handler4_common _CxxThrowException __current_exception_context __current_exception _setjmp3 __std_type_info_destroy_list __CxxFrameHandler3 memchr memset memmove __std_exception_copy memcpy longjmp strrchr _purecall strstr __std_terminate __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func fwrite fclose ftell fseek _wfopen freopen_s __stdio_common_vsprintf fread __stdio_common_vsscanf fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

api-ms-win-crt-string-l1-1-0

strncmp strcat_s strncpy

api-ms-win-crt-runtime-l1-1-0

system terminate _seh_filter_dll _configure_narrow_argv _initterm_e _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _beginthreadex

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise _libm_sse2_acos_precise _libm_sse2_cos_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_tan_precise floor ceil _CIatan2 _CIfmod _libm_sse2_sqrt_precise