example_win32_directx9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
example_win32_directx9.exe
Size 1.5MB
Sample260913-dnbxta1apb
SHA256 5d69de76e9c9f79c6a05a6a0a335f8e1ff1453aa98db986b35fa84aece963d86
MD5 717f4ac8fb788bc9b40a4731590002e4
SHA1 f1c6a7ff4789bdfb054e14fa100160f1d2827ac1
SHA512 0db7f0f24815ee8fb3ce566068715a04ea3c69e292a773157c1bdf305536c9afe2a5fc8a3ccfab083948a3eb94dc555f52bda5c402daedf94112864d52af69b8
SSDEEP 24576:/l7Mm8/sqkfayHTEPtBRWTJgLhpvuOxJQcHLTiZuW6nbEXOdoo:/OEEPtBATUvuOMcHh7nG
TLSH
T1B665AE47B3E982E8D0678634816A631FE371B80407205BCF63942B69AF73BD45F7A395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
example_win32_directx9.exe

File Explorer

example_win32_directx9.exe

.exe 1.5MB

example_win32_directx9.exe

IMPHASH fda4563e889ea5842216e4d4adc547e7
SHA256 5d69de76e9c9f79c6a05a6a0a335f8e1ff1453aa98db986b35fa84aece963d86
MD5 717f4ac8fb788bc9b40a4731590002e4
SHA1 f1c6a7ff4789bdfb054e14fa100160f1d2827ac1
SHA512 0db7f0f24815ee8fb3ce566068715a04ea3c69e292a773157c1bdf305536c9afe2a5fc8a3ccfab083948a3eb94dc555f52bda5c402daedf94112864d52af69b8
SSDEEP 24576:/l7Mm8/sqkfayHTEPtBRWTJgLhpvuOxJQcHLTiZuW6nbEXOdoo:/OEEPtBATUvuOMcHh7nG
TLSH
T1B665AE47B3E982E8D0678634816A631FE371B80407205BCF63942B69AF73BD45F7A395
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

940368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zacha\Desktop\imgui\thirdparty\imgui\examples\example_win32_directx9\Release\example_win32_directx9.pdb

d3d9

Direct3DCreate9

kernel32

FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock Sleep GetModuleHandleW CloseHandle CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceFrequency SleepConditionVariableSRW SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead HeapFree HeapAlloc ReadFile GetFileSizeEx VerSetConditionMask MultiByteToWideChar GetLocaleInfoA LoadLibraryA GetProcAddress CreateFileA GetModuleHandleA UnmapViewOfFile WakeAllConditionVariable MapViewOfFile

user32

DestroyWindow CreateWindowExW SendMessageW GetSystemMetrics DefWindowProcW SetCursor RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow UnregisterClassW OpenClipboard CloseClipboard ReleaseDC GetDC GetCursorPos EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo SetCursorPos GetClientRect SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent SetProcessDPIAware ClientToScreen GetCapture ScreenToClient IsWindowUnicode ReleaseCapture

gdi32

GetPixel

shell32

ShellExecuteA

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler __intrinsic_setjmp _CxxThrowException memcmp memchr memset memmove memcpy longjmp strrchr strchr strstr __std_terminate __std_exception_copy __current_exception __std_exception_destroy

api-ms-win-crt-math-l1-1-0

atan2f ceilf cosf fmodf roundf log acosf pow logf sinf __setusermatherr sqrtf powf

api-ms-win-crt-runtime-l1-1-0

exit _exit _wassert __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment terminate _initterm_e _configure_narrow_argv _set_app_type _initialize_narrow_environment _initialize_onexit_table _seh_filter_exe _cexit _crt_atexit _register_onexit_function

api-ms-win-crt-string-l1-1-0

strcmp strncmp strncpy strlen strcpy_s

api-ms-win-crt-convert-l1-1-0

strtol atoi atof

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func fwrite __p__commode fflush fclose fseek __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen __stdio_common_vfprintf ftell

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale