d3d10.dll?ex=670cdff9&is=670b8e79&hm=feb51fdb6e7bd3fb1e220204e1d339d7714ce0be0ebd613a7932b8c077ef68c1&
First submission 2024-10-13 18:36:02
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1078.5 KB (1104384 bytes) |
| Compile time: | 2022-11-28 16:39:59 |
| MD5: | 15c9072909a72490eb1092bcc7c037e7 |
| SHA1: | da41f3fd32d982dfcad32b818baaf41eb7003330 |
| SHA256: | ef6f600e68f76e9526edb785f37d9f7d53edc717830ec40ff8cc2a8e84319b49 |
| Import Hash : | 4f28e9d9ce05cb2af62079ae3e34c7ad |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 15/78 VT report date: 2024-10-13 17:01:37 |
| Malware Type 1 | trojan |
| Threat Type 1 | gamehack |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1128590012196323418/1130426239103021116/d3d10.dll?ex=670cdff9&is=670b8e79&hm=feb51fdb6e7bd3fb1e220204e1d339d7714ce0be0ebd613a7932b8c077ef68c1&  |
cdn.discordapp.com |
2024-10-13 18:36:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x51d5b | 335360 | 5cbc415d8e8dd033cbd1663d0c9aec652e11fbe8 | 4fe92c4f196ebad5e6351cb86f94e66e | |
| .rdata | 0x53000 | 0xb85c6 | 755200 | 4c9430c95c0bf239e83a58cb9eef3016672a9325 | 740fe5ea92022280a4c9a448347623e6 | |
| .data | 0x10c000 | 0x16e8 | 3584 | 6d328cfd6bd4a8c8d89551b24d25bd1aade2c838 | 1933138ccd354083d618a65e214d32e2 | |
| .pdata | 0x10e000 | 0x1dc4 | 7680 | 671f246ebcfdb4c82a1705a94266451da8ff160e | a82eef863c1e479e483438f2850cff02 | |
| .rsrc | 0x110000 | 0xf8 | 512 | e79f720ed2af3d00835040830730667e18c2c33e | a284a44633c038deae3a3f41f4f0dc91 | |
| .reloc | 0x111000 | 0x378 | 1024 | b337863ed21f714c7d1b5ddcfa74972e2e62ee84 | 714ffbd50af10f32466ac06566e45c6d |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x110060 | 145 |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Text |
| imgui_log.txt |
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| KERNEL32.dll |
| api-ms-win-crt-utility-l1-1-0.dll |
| api-ms-win-crt-convert-l1-1-0.dll |
| SHELL32.dll |
| msvcp140.dll |
| ntdll.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| D3DCompiler_43.dll |
| xinput9_1_0.dll |
| VCRUNTIME140_1.dll |
| IMM32.dll |
| api-ms-win-crt-filesystem-l1-1-0.dll |
| USER32.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| xinput1_3.dll |
| xinput1_1.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| xinput1_4.dll |
| api-ms-win-crt-stdio-l1-1-0.dll |
| vcruntime140.dll |
| xinput1_2.dll |
| api-ms-win-crt-math-l1-1-0.dll |
Strings analysis - Possible IPs found 1
| 127.0.0.1 |
Strings analysis - Possible URLs found 3
| http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL |
| https://fontawesome.com |
| http://www.google.com/fontshttp://www.hubertfischer.comThis |
Import functions
api-ms-win-crt-filesystem-l1-1-0.dll 3
D3DCOMPILER_43.dll 1
api-ms-win-crt-heap-l1-1-0.dll 4
api-ms-win-crt-convert-l1-1-0.dll 2
api-ms-win-crt-string-l1-1-0.dll 3
VCRUNTIME140_1.dll 1
api-ms-win-crt-runtime-l1-1-0.dll 13
KERNEL32.dll 57
api-ms-win-crt-math-l1-1-0.dll 9
api-ms-win-crt-utility-l1-1-0.dll 1
VCRUNTIME140.dll 14
SHELL32.dll 1
api-ms-win-crt-stdio-l1-1-0.dll 17
MSVCP140.dll 60
USER32.dll 24
IMM32.dll 3