d3dx11_43[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
d3dx11_43.zip
Size 36.6MB
Sample260809-rhv1dszale
SHA256 b07dae9a2c5016843fd55ad561d89ebf539941f64595cdde86504c3ce37c07a2
MD5 5d094058e8416dc6f46afae5903e2424
SHA1 9d1a5d5fb381d2a072671a49d8232a519e43c377
SHA512 797da22bc213233701b44f2fd4b8d6accbeadbca0a3265a56e90f0465a332aa84a3a2cf971a829f2255987a244e511bfd7164783ae5d2b8073d2645a90219756
SSDEEP 786432:5hMvsJHbpP8UAAhJzg0Rzhk4pppCDP+4IoaUwlQBav7OT7SCBgB:5UYuUhzgWhRJCLTIoadlDzOT7StB
TLSH
T1848733506F19D95F807E690800217FB4F2CDE323EA693876E9176B2D8575FCCE4A898C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/loader.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/d3dx11_43.dll

File Explorer

d3dx11_43.zip

.zip 36.6MB
0xc000007b_dll-outbyte-driver-updater.exe

.exe 22.3MB
README.txt

1KB
d3dx11_43.dll

.dll 242KB
loader.exe

.exe 15.8MB

d3dx11_43.zip

SHA256 b07dae9a2c5016843fd55ad561d89ebf539941f64595cdde86504c3ce37c07a2
MD5 5d094058e8416dc6f46afae5903e2424
SHA1 9d1a5d5fb381d2a072671a49d8232a519e43c377
SHA512 797da22bc213233701b44f2fd4b8d6accbeadbca0a3265a56e90f0465a332aa84a3a2cf971a829f2255987a244e511bfd7164783ae5d2b8073d2645a90219756
SSDEEP 786432:5hMvsJHbpP8UAAhJzg0Rzhk4pppCDP+4IoaUwlQBav7OT7SCBgB:5UYuUhzgWhRJCLTIoadlDzOT7StB
TLSH
T1848733506F19D95F807E690800217FB4F2CDE323EA693876E9176B2D8575FCCE4A898C
MD5 SHA1 SHA512 SSDEEP TLSH

0xc000007b_dll-outbyte-driver-updater.exe

IMPHASH 4d65eb009a5bed7efce0091931f34eb4
SHA256 168655fb1d8a0318f9ff059e30b3b32679e8e8e4062018e9ce9a0731efd7d7e4
MD5 f8402169ed3e283c4bae6f3539c79202
SHA1 2639a72a5b444464c7c8d9469e1e34e42a7d2eae
SHA512 2bc9fb71277422d12785d8a274518d69acb6110f2e3ac44f0d4b78f94864547c6ee06907c3e618261e061386d9b1cafe67918c497e4f0e7166a8dc786a9a60e2
SSDEEP 393216:/e1Jn0BZIqdso7xjrPcsIbcsKUcFhExXAwRgXSEYuAjWrA9zAT7U8AL/I7tkmYQ:4unIqplLeYFhExQU2SEYfKrA9zAfFA07
TLSH
T1F537332C53A050F5D0730338EC98EA68535BFB3B6438349557C2EF758668F512B92AEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

96:c3:f1:a5:c5:6b:ca:56:47:30:e5:bb:3a:8d:d9:51:43:4c:6a:bf:cf:c9:b3:e2:9b:b3:62:70:77:f1:65:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

Chains

May 25, 2026

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

9f:80:e7:2a:63:c5:40:f0:a1:84:48:a0:69:7a:66:2d:51:ae:92:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

Chains

May 25, 2026

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Outbyte Computing Pty Ltd,O=Outbyte Computing Pty Ltd,ST=New South Wales,C=AU

Serial Number

04:21:8e:3e:a8:1a:f4:a2:e3:98:c8:ef:bb:a2:78:16

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2026 - May 19, 2027

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

148784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetFileAttributesW EnterCriticalSection QueryDosDeviceW SetFilePointer GetACP GetExitCodeProcess LoadResource CloseHandle LocalFree GetCurrentProcessId SizeofResource GetTickCount FindNextFileW GetFullPathNameW VirtualFree GetFileSize GetStartupInfoW ExitProcess GetFileAttributesW InitializeCriticalSection GetCurrentProcess VirtualAlloc RtlUnwind GetCPInfo GetCommandLineW GetSystemInfo GetProcAddress LeaveCriticalSection EnumSystemLocalesW GetStdHandle GetLogicalDriveStringsW FileTimeToLocalFileTime GetVersionExW VerifyVersionInfoW GetModuleHandleW FreeLibrary GetWindowsDirectoryW FileTimeToDosDateTime ReadFile GetDiskFreeSpaceW VerSetConditionMask GetUserDefaultUILanguage FindFirstFileW CreateProcessW UnmapViewOfFile SetLastError GetModuleFileNameW GetLastError FindResourceW lstrlenW SetEndOfFile QueryPerformanceCounter CompareStringW WideCharToMultiByte MapViewOfFile MultiByteToWideChar FindClose LoadLibraryW LoadLibraryA GetVolumeInformationW ResetEvent SetEvent CreateFileW GetLocaleInfoW GetDriveTypeW GetVersion DeleteFileW RaiseException FormatMessageW SwitchToThread GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW DeleteCriticalSection TlsGetValue IsValidLocale TlsSetValue CreateDirectoryW LockResource LoadLibraryExW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW GetCurrentThreadId UnhandledExceptionFilter VirtualQuery CreateEventW GetThreadLocale Sleep SetThreadLocale

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects TranslateMessage CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics DispatchMessageW MessageBoxW

oleaut32

SysAllocStringLen SysFreeString SysReAllocStringLen

netapi32

NetWkstaGetInfo NetApiBufferFree

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

Name

.text

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

310KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

d3dx11_43.dll

IMPHASH a21b4a7ea49a55d76ec8ead5ff32f73d
SHA256 492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
MD5 8e0bb968ff41d80e5f2c747c04db79ae
SHA1 69b332d78020177a9b3f60cb672ec47578003c0d
SHA512 7d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506
SSDEEP 6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
TLSH
T1C7345BA1EA00513AE8F6D2B4211D732151F9DE3007F2E3CB165CABDAACB56D18A347D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3e:ac:fb:b6:70:f6:65:34:9c:0a:21:69:7e:23:e4:07:49:b9:c0:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 22, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

201030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dx11_43.pdb

msvcrt

??1type_info@@UAE@XZ ?terminate@@YAXXZ _onexit _lock __dllonexit _unlock memmove _amsg_exit _initterm _XcptFilter malloc _callnewh free ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ?what@exception@@UBEPBDXZ ??0exception@@QAE@XZ _CxxThrowException _isnan _controlfp floor memset _purecall _CIsqrt memcpy _vsnwprintf __CxxFrameHandler

kernel32

WideCharToMultiByte WriteFile LockResource FindResourceW SizeofResource FindResourceA GetVersion SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter RtlUnwind InterlockedCompareExchange InterlockedExchange OutputDebugStringA IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection CreateFileA GetCurrentProcess GetProcessAffinityMask CreateThread InterlockedIncrement Sleep WaitForSingleObject InterlockedDecrement DebugBreak WaitForMultipleObjects ReleaseSemaphore ReleaseMutex CreateSemaphoreA CreateMutexA CreateFileW CloseHandle GetFileSizeEx ReadFile MultiByteToWideChar GetFullPathNameW GetLastError GetModuleHandleA LoadLibraryA FreeLibrary GetProcAddress DisableThreadLibraryCalls LoadResource

ole32

CreateStreamOnHGlobal

gdi32

DeleteObject

loader.exe

IMPHASH 2cc75fcf75623d451f0e39296bc145d7
SHA256 0a9b7b933c13a1bfc9916903e9b3b782b15e2aaad53587884d4e5b10edc1cb3b
MD5 cea9eaffd88d6d859b6013e2ef323748
SHA1 0a16ed86366a0d510d4ab1f8f6aae95e4f3ee635
SHA512 c0acdfe5fa9f956d0c8a77cc75785ae058c2e160db9e57289b59d03e9b86c7eaabb46a0820ece01df405e99bd014100ef613c0d4b5ad21b6d629f5f07a724598
SSDEEP 393216:boNADcxpTX00NBl+wPbnFsv0rTI7UHoivPBE+zocr+J:bcS10NBRXTAwvP/7+J
TLSH
T13FF623979ED803D8E7A3CF00F79673A9A59133265E9D884D158A38072933C57C98AD3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25210043

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

GetCurrentHwProfileA

ktmw32

CreateTransaction

ntdll

NtCreateSection

kernel32

GetSystemTimeAsFileTime GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

GetKeyState

ole32

CoInitializeEx

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

wininet

InternetCloseHandle

imm32

ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryDataAvailable

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

677KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

447KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

15.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.`!l

Size

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.1cd

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.b><

Size

15.7MB

Virtual Size

15.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d3dx11_43.zip

0xc000007b_dll-outbyte-driver-updater.exe

kernel32

version

user32

oleaut32

netapi32

advapi32

generic

README.txt

d3dx11_43.dll

PE Signature issue

msvcrt

kernel32

ole32

gdi32

generic

loader.exe

d3dx11_43

d3d11

advapi32

ktmw32

ntdll

kernel32

user32

ole32

msvcp140

wininet

imm32

d3dcompiler_47

dwmapi

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic