d2d1[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

d2d1.dll
Size

5.1MB
MD5

7b83997468f32ac8ba05f108a0ca769a
SHA1

fa47e05b862aaadee3813e61f9195a6ad1525087
SHA256

7a96264d5960f24b480bac42c430752e3a449c194fe91086c4cdf76dd641c5a2
SHA512

fd59746981271c257cc62a41e67a393046fdea822c5d028976668b9cd5c482a92a5272fe6340fb13f83e9efe331826ed77d484e6232ad2e8a7683597ac0382e2
SSDEEP

98304:8vwUmPz/S+9fwmPM+w/9oFIXw+WAjyDhAHwRTnCN3Jvr+SrYnD95W:87GfwmU+MmIX7WAjyDaHwRTnQ3Jvr+Sl

Score

1^/10

Malware Config

Signatures

Files

d2d1.dll
.dll windows:10 windows x86 arch:x86

fd19187500dbf75c039839d3d18df713

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:f3:a0:57:1c:30:ca:28:12:c7:18:90:1c:2c:d1:66:98:f6:de:08:a2:7a:01:f3:94:83:1c:ca:eb:a0:86:de
Signer

Actual PE Digest

83:f3:a0:57:1c:30:ca:28:12:c7:18:90:1c:2c:d1:66:98:f6:de:08:a2:7a:01:f3:94:83:1c:ca:eb:a0:86:de

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d2d1.pdb

Imports

msvcrt

?terminate@@YAXXZ
??1type_info@@UAE@XZ
wcschr
_aligned_malloc
_aligned_realloc
_aligned_free
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
wcstod
iswalpha
_wcsnicmp
iswspace
_wcsicmp
wcsncmp
_isnan
_vsnprintf
_libm_sse2_tan_precise
ceil
floor
memmove
modf
memcpy
_CxxThrowException
time
strstr
_itow_s
_snprintf_s
swscanf_s
memcmp
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
wcstol
realloc
memmove_s
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_log_precise
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_libm_sse2_acos_precise
_ftol2
_CIsqrt
_CIsin
_CIfmod
memcpy_s
_vsnwprintf
_finite
_purecall
_callnewh
malloc
tolower
free
_CIcos
_CIatan2
_CIatan
memset

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceExW
LoadLibraryExW
GetProcAddress
LockResource
GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
ReleaseSemaphore
SetEvent
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockExclusive
WaitForSingleObjectEx
AcquireSRWLockShared
CreateMutexExW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OpenSemaphoreW
CreateEventW
ReleaseSRWLockShared

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount64
GlobalMemoryStatusEx
GetSystemDirectoryW
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

ntdll

RtlClearBits
RtlAreBitsSet
RtlInitializeBitMap
EtwEventUnregister
EtwEventRegister
EtwEventSetInformation
vDbgPrintEx
RtlHashUnicodeString
WinSqmAddToStream
WinSqmAddToAverageDWORD
WinSqmIncrementDWORD
WinSqmIsOptedIn
WinSqmAddToStreamEx
DbgPrintEx
DbgPrint
EtwEventWriteTransfer
RtlSetBit

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle
GlobalLock
GlobalSize
GlobalReAlloc
GlobalUnlock

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-file-l1-1-0

ReadFile
GetFileSize
CreateFileW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

Exports

Exports

D2D1ComputeMaximumScaleFactor
D2D1ConvertColorSpace
D2D1CreateDevice
D2D1CreateDeviceContext
D2D1CreateFactory
D2D1GetGradientMeshInteriorPointsFromCoonsPatch
D2D1InvertMatrix
D2D1IsMatrixInvertible
D2D1MakeRotateMatrix
D2D1MakeSkewMatrix
D2D1SinCos
D2D1Tan
D2D1Vec3Length

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd19187500dbf75c039839d3d18df713

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

83:f3:a0:57:1c:30:ca:28:12:c7:18:90:1c:2c:d1:66:98:f6:de:08:a2:7a:01:f3:94:83:1c:ca:eb:a0:86:deSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

ntdll

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-memory-l1-1-0

Exports

Exports

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.data Size: 9KB - Virtual size: 11KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 228B

.rsrc Size: 71KB - Virtual size: 71KB

.reloc Size: 151KB - Virtual size: 150KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

83:f3:a0:57:1c:30:ca:28:12:c7:18:90:1c:2c:d1:66:98:f6:de:08:a2:7a:01:f3:94:83:1c:ca:eb:a0:86:de
Signer

.text
Size: 4.8MB - Virtual size: 4.8MB

.data
Size: 9KB - Virtual size: 11KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 228B

.rsrc
Size: 71KB - Virtual size: 71KB

.reloc
Size: 151KB - Virtual size: 150KB