example_win32_directx11[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
example_win32_directx11.dll
Size 6.3MB
Sample260822-2h7paszfpg
SHA256 af1af0241f373ba199b7cbe9670b682eda246364dc21ea237846d14c694b9259
MD5 97909faadddcd820d239ec5430970e86
SHA1 4df9da35db377e5d78275029f9ee21e39fb72ae2
SHA512 1f0524a96b115340be3efd84f5420aa2d1bb86596a6eaa27e1339b3e4f0157a0db7593d932e6fe6c4c1f647cc035a2a9af023a6a2f8d548e2e160e19234c841c
SSDEEP 98304:w6Ey3vjVGxTpGTZ00QvuPomld/CoDZ1Jsc+Tq+5DQwgrY67Cb:REy3rVaTpGW7mPomKoDZUZHgczb
TLSH
T16C660146E2978238DF67573984669333D6B07CC443A08BC76BAD89746F63AF06A7C740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
example_win32_directx11.dll

File Explorer

example_win32_directx11.dll

.dll 6.3MB

example_win32_directx11.dll

IMPHASH bd8746b0bdf949847c6a28438b637c92
SHA256 af1af0241f373ba199b7cbe9670b682eda246364dc21ea237846d14c694b9259
MD5 97909faadddcd820d239ec5430970e86
SHA1 4df9da35db377e5d78275029f9ee21e39fb72ae2
SHA512 1f0524a96b115340be3efd84f5420aa2d1bb86596a6eaa27e1339b3e4f0157a0db7593d932e6fe6c4c1f647cc035a2a9af023a6a2f8d548e2e160e19234c841c
SSDEEP 98304:w6Ey3vjVGxTpGTZ00QvuPomld/CoDZ1Jsc+Tq+5DQwgrY67Cb:REy3rVaTpGW7mPomKoDZUZHgczb
TLSH
T16C660146E2978238DF67573984669333D6B07CC443A08BC76BAD89746F63AF06A7C740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

985456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\v7\joyst\Joyst Corporation Silent AIM C++\examples\x64\Release\example_win32_directx11.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

windivert

WinDivertClose WinDivertOpen WinDivertRecv WinDivertSend

dwmapi

DwmExtendFrameIntoClientArea

kernel32

FreeConsole ReadFile GetModuleFileNameA GetLogicalDrives SetHandleInformation WriteFile TerminateProcess CreatePipe WaitForSingleObject SetCurrentDirectoryA K32GetModuleFileNameExA CreateProcessA GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx VirtualProtect AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileSizeEx CreateFileA WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection Process32First LocalFree FormatMessageA SetLastError QueryFullProcessImageNameW GetModuleFileNameW UnmapViewOfFile MapViewOfFile CreateFileMappingW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize CreateFileW OpenThread SetThreadContext FlushInstructionCache GetModuleHandleW HeapCreate VirtualQuery GetSystemInfo VirtualAlloc VirtualFree GlobalUnlock GlobalLock IsDebuggerPresent OutputDebugStringW GlobalFree GlobalAlloc CreateThread DisableThreadLibraryCalls CloseHandle QueryFullProcessImageNameA OpenProcess GetTickCount GetCurrentProcessId GetThreadContext HeapDestroy HeapAlloc HeapReAlloc GetLastError Sleep CreateToolhelp32Snapshot ResumeThread WideCharToMultiByte FreeLibraryAndExitThread QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA CreateFile2 AreFileApisANSI InitializeSListHead GetFileInformationByHandleEx WakeAllConditionVariable GetSystemTimeAsFileTime SuspendThread GetCurrentThreadId Thread32First Thread32Next GetCurrentProcess Process32Next EnterCriticalSection HeapFree SleepConditionVariableSRW

user32

SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA ReleaseCapture SetCursor InvalidateRect UpdateWindow PeekMessageA TranslateMessage SetWindowDisplayAffinity GetClientRect DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard RegisterClassExA GetKeyState IsWindowUnicode GetCursorPos GetMessageExtraInfo SetWindowPos SetWindowLongA MessageBoxA SetForegroundWindow GetWindowThreadProcessId EnumChildWindows SetCursorPos GetClassNameA GetWindowTextA EnumWindows DestroyWindow ShowWindow MapWindowPoints MoveWindow GetAsyncKeyState DefWindowProcA CreateWindowExA SetLayeredWindowAttributes UnregisterClassA

advapi32

RegDeleteValueA CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext RegCreateKeyExA RegQueryValueExA RegCloseKey OpenProcessToken CopySid GetLengthSid GetTokenInformation IsValidSid RegSetValueExA ConvertSidToStringSidA CryptAcquireContextA RegOpenKeyExA

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_frequency _Thrd_yield ?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join ?_Random_device@std@@YAIXZ _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ

d3dcompiler_43

D3DCompile

iphlpapi

GetExtendedUdpTable

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipBitmapLockBits GdipCreateBitmapFromFile GdipDisposeImage GdipAlloc GdipBitmapUnlockBits GdipCloneImage GdiplusStartup GdiplusShutdown GdipFree

normaliz

IdnToAscii

wldap32

ord217 ord46 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord211 ord33 ord35 ord79 ord30 ord200 ord301 ord143

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertGetCertificateChain CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetNameStringA CertFindCertificateInStore

ws2_32

gethostname sendto ntohl WSAIoctl ntohs closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons setsockopt socket getaddrinfo WSASetLastError recvfrom WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select freeaddrinfo

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception strrchr __std_type_info_destroy_list memset __std_terminate memcpy __current_exception_context __C_specific_handler memcmp memchr _CxxThrowException strstr strchr __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh calloc free

api-ms-win-crt-runtime-l1-1-0

_getpid _initterm_e _initterm _cexit system _crt_atexit _execute_onexit_table _register_onexit_function exit _initialize_onexit_table _initialize_narrow_environment strerror __sys_nerr _configure_narrow_argv _invalid_parameter_noinfo _seh_filter_dll _beginthreadex _resetstkoflw terminate abort _invalid_parameter_noinfo_noreturn _errno

api-ms-win-crt-string-l1-1-0

strcmp _stricmp strncpy strcpy_s isprint strpbrk strncmp _strdup isupper strspn tolower strlen strcspn

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-stdio-l1-1-0

fputs fopen _read _write _close _open ftell __acrt_iob_func fflush feof fclose fseek __stdio_common_vfprintf fwrite _wfopen __stdio_common_vsprintf ungetc setvbuf _popen _pclose _fseeki64 fsetpos fputc fgets fgetpos fgetc _get_stream_buffer_pointers _lseeki64 fread __stdio_common_vsscanf

api-ms-win-crt-convert-l1-1-0

strtoul strtoll strtol atoi strtod atof strtoull

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime _localtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64 _access _unlink _fstat64 _lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-math-l1-1-0

powf atan2f sinf sqrt logf log pow _dclass fmodf acosf sin cosf asin cos ceilf sqrtf

shell32

ShellExecuteA