example_win32_directx11[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
example_win32_directx11.exe
Size 1.2MB
Sample260810-qeecsshq7w
SHA256 b41886d8094e42fc412f1a53b617eb25535aed74b9639e272c22f1cc7f1e602e
MD5 60d6d251e0feadbd27f27fc8faa97b4a
SHA1 b870bff9b4d1c250b8c51e7b83646bf87113dda7
SHA512 e58179671b5b1b5fe843817ef7f82be076a8253435756751513d94e21b7fe3b490ba53def564775f83edf2b1a655bc0a00e9d892d19bf9943343b4cfc82c1749
SSDEEP 24576:lqyXqBXiGpLMwAE1chj5Cvb7wnd0kRMxMmABlNGwBcDDLxY3:4Kq9THChjAvQndvsLm
TLSH
T1E745AE13E3A002B9D067A038CA97D313E73278861B5097CB779449297FA36E05E7BBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
example_win32_directx11.exe

File Explorer

example_win32_directx11.exe

.exe 1.2MB

example_win32_directx11.exe

IMPHASH 30a286d1802894f51429686ee524d5a7
SHA256 b41886d8094e42fc412f1a53b617eb25535aed74b9639e272c22f1cc7f1e602e
MD5 60d6d251e0feadbd27f27fc8faa97b4a
SHA1 b870bff9b4d1c250b8c51e7b83646bf87113dda7
SHA512 e58179671b5b1b5fe843817ef7f82be076a8253435756751513d94e21b7fe3b490ba53def564775f83edf2b1a655bc0a00e9d892d19bf9943343b4cfc82c1749
SSDEEP 24576:lqyXqBXiGpLMwAE1chj5Cvb7wnd0kRMxMmABlNGwBcDDLxY3:4Kq9THChjAvQndvsLm
TLSH
T1E745AE13E3A002B9D067A038CA97D313E73278861B5097CB779449297FA36E05E7BBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

612060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\oscaw\Downloads\PCTweaker\PCTweaker\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

ntdll

RtlCaptureContext VerSetConditionMask RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStdHandle WaitForSingleObjectEx MoveFileExA GetTickCount VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetCurrentProcessId GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter CreateFileA FindNextFileA GlobalLock FormatMessageA GetEnvironmentVariableA FindClose OpenProcess Sleep K32GetModuleFileNameExA GetFileAttributesA WaitForMultipleObjects CloseHandle K32EnumProcesses GetLogicalDrives GetDriveTypeA K32GetModuleBaseNameA K32EnumProcessModules InitializeCriticalSectionEx DeleteCriticalSection GlobalFree GlobalAlloc WideCharToMultiByte MultiByteToWideChar GetLastError GetCurrentProcess SetLastError OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetFileSizeEx PeekNamedPipe ReadFile FindFirstFileA GetFileType

user32

ScreenToClient GetKeyState UpdateWindow PostQuitMessage GetCapture PeekMessageA LoadIconA TranslateMessage SetLayeredWindowAttributes MoveWindow ClientToScreen GetWindowLongA SetWindowLongA GetAsyncKeyState ShowWindow RegisterClassExW UnregisterClassW LoadCursorA GetSystemMetrics GetForegroundWindow CreateWindowExW DestroyWindow SetClipboardData SetCapture SetCursor GetWindowRect GetClientRect DispatchMessageA DefWindowProcW IsWindowUnicode ReleaseCapture SetCursorPos TrackMouseEvent GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData

advapi32

CryptImportKey RegEnumKeyExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptEncrypt

shell32

ShellExecuteA

msvcp140

_Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Query_perf_counter ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Query_perf_frequency ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

normaliz

IdnToAscii

wldap32

ord46 ord41 ord217 ord143 ord211 ord26 ord27 ord32 ord33 ord35 ord50 ord22 ord45 ord79 ord30 ord200 ord301 ord60

crypt32

CertCloseStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CertEnumCertificatesInStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertFindCertificateInStore

ws2_32

getsockname getaddrinfo closesocket recv send getsockopt htons ntohs setsockopt WSAGetLastError bind connect socket ntohl gethostname sendto recvfrom freeaddrinfo getpeername select __WSAFDIsSet ioctlsocket listen htonl WSASetLastError accept WSACleanup WSAStartup WSAIoctl

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr memset __current_exception_context __C_specific_handler memmove __current_exception strchr __std_exception_destroy memcpy __std_exception_copy __std_terminate _CxxThrowException memchr memcmp strstr

api-ms-win-crt-stdio-l1-1-0

fread fwrite __p__commode _lseeki64 __stdio_common_vsscanf fseek __stdio_common_vsprintf _pclose __stdio_common_vfprintf fputs fopen fgets _popen _read _write _close fclose fflush _open __acrt_iob_func _wfopen _set_fmode ftell fputc feof

api-ms-win-crt-runtime-l1-1-0

system terminate _beginthreadex _invalid_parameter_noinfo_noreturn _errno _invoke_watson strerror __sys_nerr _wassert _getpid _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit exit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy tolower strcspn strncmp strpbrk strcmp isupper _strdup strspn

api-ms-win-crt-heap-l1-1-0

realloc _callnewh calloc free _set_new_mode malloc

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtoul atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

sqrtf cosf powf roundf sinf __setusermatherr acosf logf ceilf

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_access _stat64 _fstat64 _unlink