Report - dx9_overlay.dll

UPX Malicious Library OS Processor Check DLL PE File PE32
ScreenShot
Created 2023.08.02 20:51 Machine s1_win7_x6401
Filename dx9_overlay.dll
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
1.0
ZERO API file : mailcious
VT API (file) 2 detected (grayware, confidence, BScope, Wacatac)
md5 b820ca941ae4e895d4e172de1605a1fd
sha256 24c802a366b3780a4d9745a900b69a4bc8d2c8702a03a8c11bf17997c0db7eaf
ssdeep 12288:imkSnRikoRDegfDybtFDpJHqNMHBz2W5z02XNv3DfyZqp7oZTOQJ:iHm+ybfD7HqmBztz/R3uZfZqQJ
imphash c452ef013ad35a9bd010623596b32cc5
impfuzzy 96:y/mLc+vGx1X173ysX+k9th1XpeSOpuTwU5:y9F73HOkPauEU5
  Network IP location

Signature (4cnts)

Level Description
notice File has been identified by 2 AntiVirus engines on VirusTotal as malicious
info Checks amount of memory in system
info One or more processes crashed
info This executable has a PDB path

Rules (6cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x10078038 lstrlenW
 0x1007803c GetSystemTimeAsFileTime
 0x10078040 MultiByteToWideChar
 0x10078044 MulDiv
 0x10078048 Process32First
 0x1007804c Process32Next
 0x10078050 CreateToolhelp32Snapshot
 0x10078054 CallNamedPipeA
 0x10078058 ConnectNamedPipe
 0x1007805c WriteFile
 0x10078060 GetProcessHeap
 0x10078064 HeapAlloc
 0x10078068 CreateThread
 0x1007806c HeapFree
 0x10078070 SetEvent
 0x10078074 ReadFile
 0x10078078 GetOverlappedResult
 0x1007807c DisconnectNamedPipe
 0x10078080 GetLastError
 0x10078084 CreateNamedPipeA
 0x10078088 WaitForMultipleObjects
 0x1007808c ResumeThread
 0x10078090 DisableThreadLibraryCalls
 0x10078094 Sleep
 0x10078098 WriteProcessMemory
 0x1007809c CloseHandle
 0x100780a0 GetModuleHandleA
 0x100780a4 GetModuleFileNameA
 0x100780a8 GetExitCodeThread
 0x100780ac VirtualAllocEx
 0x100780b0 GetProcAddress
 0x100780b4 VirtualFreeEx
 0x100780b8 OpenProcess
 0x100780bc CreateRemoteThread
 0x100780c0 CreateEventA
 0x100780c4 WaitForSingleObject
 0x100780c8 ResetEvent
 0x100780cc OpenEventA
 0x100780d0 VirtualQuery
 0x100780d4 WideCharToMultiByte
 0x100780d8 GetCurrentThreadId
 0x100780dc EncodePointer
 0x100780e0 DecodePointer
 0x100780e4 EnterCriticalSection
 0x100780e8 LeaveCriticalSection
 0x100780ec DeleteCriticalSection
 0x100780f0 GetStringTypeW
 0x100780f4 GetCommandLineA
 0x100780f8 GetCPInfo
 0x100780fc RaiseException
 0x10078100 RtlUnwind
 0x10078104 CreateTimerQueue
 0x10078108 WaitForSingleObjectEx
 0x1007810c SignalObjectAndWait
 0x10078110 GetCurrentProcess
 0x10078114 SwitchToThread
 0x10078118 SetThreadPriority
 0x1007811c GetThreadPriority
 0x10078120 TlsAlloc
 0x10078124 TlsGetValue
 0x10078128 TlsSetValue
 0x1007812c TlsFree
 0x10078130 GetLogicalProcessorInformation
 0x10078134 CreateTimerQueueTimer
 0x10078138 ChangeTimerQueueTimer
 0x1007813c DeleteTimerQueueTimer
 0x10078140 GetModuleHandleW
 0x10078144 GetNumaHighestNodeNumber
 0x10078148 GetProcessAffinityMask
 0x1007814c SetThreadAffinityMask
 0x10078150 RegisterWaitForSingleObject
 0x10078154 UnregisterWait
 0x10078158 IsProcessorFeaturePresent
 0x1007815c UnhandledExceptionFilter
 0x10078160 SetUnhandledExceptionFilter
 0x10078164 SetLastError
 0x10078168 InitializeCriticalSectionAndSpinCount
 0x1007816c CreateEventW
 0x10078170 TerminateProcess
 0x10078174 GetStartupInfoW
 0x10078178 GetTickCount
 0x1007817c CreateSemaphoreW
 0x10078180 GetDateFormatW
 0x10078184 GetTimeFormatW
 0x10078188 CompareStringW
 0x1007818c LCMapStringW
 0x10078190 GetLocaleInfoW
 0x10078194 IsValidLocale
 0x10078198 GetUserDefaultLCID
 0x1007819c EnumSystemLocalesW
 0x100781a0 IsDebuggerPresent
 0x100781a4 GetCurrentThread
 0x100781a8 ExitProcess
 0x100781ac GetModuleHandleExW
 0x100781b0 AreFileApisANSI
 0x100781b4 HeapSize
 0x100781b8 IsValidCodePage
 0x100781bc GetACP
 0x100781c0 GetOEMCP
 0x100781c4 GetTimeZoneInformation
 0x100781c8 GetStdHandle
 0x100781cc GetFileType
 0x100781d0 QueryPerformanceCounter
 0x100781d4 GetCurrentProcessId
 0x100781d8 GetEnvironmentStringsW
 0x100781dc FreeEnvironmentStringsW
 0x100781e0 GetModuleFileNameW
 0x100781e4 HeapReAlloc
 0x100781e8 OutputDebugStringW
 0x100781ec GetThreadTimes
 0x100781f0 FreeLibrary
 0x100781f4 FreeLibraryAndExitThread
 0x100781f8 LoadLibraryExW
 0x100781fc GetVersionExW
 0x10078200 VirtualAlloc
 0x10078204 VirtualFree
 0x10078208 VirtualProtect
 0x1007820c DuplicateHandle
 0x10078210 ReleaseSemaphore
 0x10078214 InitializeSListHead
 0x10078218 InterlockedPopEntrySList
 0x1007821c InterlockedPushEntrySList
 0x10078220 InterlockedFlushSList
 0x10078224 QueryDepthSList
 0x10078228 UnregisterWaitEx
 0x1007822c GetConsoleCP
 0x10078230 GetConsoleMode
 0x10078234 SetFilePointerEx
 0x10078238 LoadLibraryW
 0x1007823c SetStdHandle
 0x10078240 WriteConsoleW
 0x10078244 FlushFileBuffers
 0x10078248 CreateFileW
 0x1007824c ReadConsoleW
 0x10078250 SetEnvironmentVariableA
 0x10078254 GetCurrentDirectoryW
 0x10078258 GetFileAttributesW
 0x1007825c DeviceIoControl
 0x10078260 LocalFree
 0x10078264 FormatMessageA
 0x10078268 FlushInstructionCache
 0x1007826c ExitThread
USER32.dll
 0x10078274 FindWindowA
 0x10078278 GetWindowThreadProcessId
GDI32.dll
 0x10078000 SetTextColor
 0x10078004 DeleteDC
 0x10078008 CreateDIBSection
 0x1007800c GetDeviceCaps
 0x10078010 SetBkColor
 0x10078014 DeleteObject
 0x10078018 SelectObject
 0x1007801c CreateCompatibleDC
 0x10078020 SetMapMode
 0x10078024 ExtTextOutW
 0x10078028 CreateFontW
 0x1007802c SetTextAlign
 0x10078030 GetTextExtentPoint32W
d3dx9_43.dll
 0x10078280 D3DXMatrixTransformation2D
 0x10078284 D3DXCreateTextureFromFileA
 0x10078288 D3DXCreateSprite
 0x1007828c D3DXCreateLine

EAT(Export Address Table) Library

0x10096e40 ??_B?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
0x10096e20 ??_B?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
0x10096e64 ??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
0x10039930 ?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
0x100383a0 ?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
0x1003ab70 ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
0x10039930 ?get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
0x100383a0 ?get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
0x1003ab70 ?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
0x10039930 ?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
0x100383a0 ?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
0x1003ab70 ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
0x10096e30 ?instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
0x10096e10 ?instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
0x10096e54 ?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
0x10039b50 ?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
0x10038560 ?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
0x1003abf0 ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
0x10096e38 ?t@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
0x10096e18 ?t@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
0x10096e5c ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@st
0x100077e0 BoxCreate
0x10007920 BoxDestroy
0x10007b10 BoxSetBorder
0x10007c20 BoxSetBorderColor
0x10007d20 BoxSetColor
0x10007e20 BoxSetHeight
0x10007f20 BoxSetPos
0x10007a10 BoxSetShown
0x10008030 BoxSetWidth
0x10008f80 DestroyAllVisual
0x100091f0 GetFrameRate
0x100092d0 GetScreenSpecs
0x10009120 HideAllVisual
0x100087a0 ImageCreate
0x10008a80 ImageDestroy
0x10008c70 ImageSetAlign
0x10008d70 ImageSetPos
0x10008e80 ImageSetRotation
0x10008b70 ImageSetShown
0x10003470 Init
0x10008130 LineCreate
0x10008280 LineDestroy
0x10008470 LineSetColor
0x10008670 LineSetPos
0x10008370 LineSetShown
0x10008570 LineSetWidth
0x100093c0 SetCalculationRatio
0x100094a0 SetOverlayPriority
0x100032c0 SetParam
0x10009050 ShowAllVisual
0x100068d0 TextCreate
0x10006b00 TextCreateUnicode
0x10006d40 TextDestroy
0x10007030 TextSetColor
0x10007130 TextSetPos
0x10006e30 TextSetShadow
0x10006f30 TextSetShown
0x10007240 TextSetString
0x10007390 TextSetStringUnicode
0x100074e0 TextUpdate
0x10007660 TextUpdateUnicode
0x1000d870 enable


Similarity measure (PE file only) - Checking for service failure