d3d9[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3d9.dll
Size

1.7MB
MD5

6ef5f3f18413c367195f06e503ab86a6
SHA1

74e5861dd61d6ddec17dc802664e26196d628bc9
SHA256

6f8b87fb4d67f9e76a51ef759b58a95d903c4aac9c789a65a3fa1fc4f253d978
SHA512

eaa3c0a9e711e22d408d745d727751983c982dd54372c2a474b64a908b167d0f521ab69e6a6fbdcc3f28c8b19b9b0ab51ce038584d2a562ef2775275e01f2e60
SSDEEP

49152:zFOurm+vTyV0T+K5tCbRm9uygrQrgs12iO6pg:0+9T+K5tYRm9stghp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3d9.dll

Files

d3d9.dll
.dll windows:6 windows x86 arch:x86

a0645f8b8ef977aa10f9cbb25803a746

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d9.pdb

Imports

msvcrt

_aligned_realloc
memchr
_strdup
strtoul
??0exception@@QAE@ABQBD@Z
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
memmove_s
memcpy_s
??0exception@@QAE@ABV0@@Z
floor
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_onexit
_CIexp
qsort
_aligned_free
_CIcos
__CxxFrameHandler3
memcpy
_amsg_exit
_initterm
_XcptFilter
realloc
free
malloc
_CIlog10
strstr
isalnum
sscanf
strrchr
_purecall
ceil
_stricmp
memmove
_vsnprintf
_ftol2_sse
memset
_CIsqrt
_CIsin
_CIpow
_CIlog
_CxxThrowException
?terminate@@YAXXZ
_aligned_malloc
atoi

ntdll

WinSqmIsOptedIn
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsA
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlIsCriticalSectionLockedByThread
RtlInitUnicodeString
NtQueryLicenseValue
VerSetConditionMask
EtwLogTraceEvent
WinSqmAddToStreamEx

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExA

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
AddAccessAllowedAce
SetSecurityDescriptorSacl
SetKernelObjectSecurity
IsValidSid
GetLengthSid
InitializeAcl
AddMandatoryAce
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
InitializeSecurityDescriptor

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

user32

UnionRect
IsWindowUnicode
GetWindowLongW
GetWindowLongA
ClientToScreen
SetRect
GetWindowInfo
GetClientRect
EnumDisplaySettingsA
OffsetRect
GetSystemMetrics
EnumDisplayMonitors
GetDC
ReleaseDC
EnumDisplayDevicesA
SetWindowPos
SystemParametersInfoA
GetMonitorInfoA
IntersectRect
DefWindowProcA
SetForegroundWindow
SetTimer
IsZoomed
ShowWindow
IsWindowVisible
GetForegroundWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PtInRect
GetCursorPos
SetCursorPos
GetDesktopWindow
GetWindowDC
CreateIconIndirect
GetWindowRect
GetCursor
SetCursor
DestroyIcon
GetAncestor
IsProcessDPIAware
mouse_event
GetWindowDisplayAffinity
SetWindowDisplayAffinity
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
RegisterHotKey
UnregisterHotKey
IsWindow
KillTimer
SetWindowLongW
CallWindowProcW
SetWindowLongA
CallWindowProcA
SendMessageA
IsIconic
PostMessageA
GetKeyState
SetRectEmpty
SfmDxGetSwapChainStats
NotifyOverlayWindow

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

d3d8thk

OsThunkD3dContextDestroyAll
OsThunkDdGetScanLine
OsThunkDdUnlockD3D
OsThunkDdUnlock
OsThunkDdSetExclusiveMode
OsThunkDdFlipToGDISurface
OsThunkDdGetMoCompGuids
OsThunkDdGetMoCompFormats
OsThunkDdGetInternalMoCompInfo
OsThunkDdGetMoCompBuffInfo
OsThunkDdCreateMoComp
OsThunkDdDestroyMoComp
OsThunkDdBeginMoCompFrame
OsThunkDdEndMoCompFrame
OsThunkDdRenderMoComp
OsThunkDdQueryMoCompStatus
OsThunkDdDeleteDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdReenableDirectDrawObject
OsThunkDdDestroyD3DBuffer
OsThunkDdDestroySurface
OsThunkDdDeleteSurfaceObject
OsThunkDdSetGammaRamp
OsThunkDdCreateSurfaceEx
OsThunkDdCreateSurface
OsThunkDdCreateD3DBuffer
OsThunkDdAttachSurface
OsThunkDdCreateSurfaceObject
OsThunkDdCanCreateSurface
OsThunkDdCanCreateD3DBuffer
OsThunkD3dContextCreate
OsThunkD3dContextDestroy
OsThunkDdGetDriverState
OsThunkD3dValidateTextureStageState
OsThunkD3dDrawPrimitives2
OsThunkDdResetVisrgn
OsThunkDdLockD3D
OsThunkDdLock
OsThunkDdGetBltStatus
OsThunkDdQueryDirectDrawObject
OsThunkDdBlt
OsThunkDdGetDC
OsThunkDdGetDriverInfo
OsThunkDdGetAvailDriverMemory
OsThunkDdWaitForVerticalBlank
OsThunkDdGetFlipStatus
OsThunkDdFlip

gdi32

D3DKMTSignalSynchronizationObject2
D3DKMTGetRuntimeData
D3DKMTQueryAdapterInfo
D3DKMTLock
D3DKMTUnlock
D3DKMTGetDisplayModeList
D3DKMTSetDisplayMode
D3DKMTGetMultisampleMethodList
D3DKMTSignalSynchronizationObject
D3DKMTRender
D3DKMTOpenAdapterFromDeviceName
D3DKMTCloseAdapter
D3DKMTGetSharedPrimaryHandle
D3DKMTEscape
D3DKMTSetVidPnSourceOwner
D3DKMTWaitForVerticalBlankEvent
D3DKMTSetGammaRamp
D3DKMTGetDeviceState
D3DKMTCreateDCFromMemory
D3DKMTDestroyDCFromMemory
D3DKMTSetContextSchedulingPriority
D3DKMTWaitForSynchronizationObject2
D3DKMTWaitForSynchronizationObject
D3DKMTDestroySynchronizationObject
D3DKMTCreateSynchronizationObject2
D3DKMTCreateSynchronizationObject
D3DKMTDestroyContext
D3DKMTCreateContext
D3DKMTDestroyDevice
D3DKMTCreateDevice
D3DKMTQueryAllocationResidency
D3DKMTSetAllocationPriority
D3DKMTDestroyAllocation
D3DKMTOpenResource2
D3DKMTOpenResource
D3DKMTQueryResourceInfo
D3DKMTCreateAllocation2
D3DKMTCreateAllocation
D3DKMTOpenAdapterFromHdc
GetSystemPaletteEntries
CreateDIBitmap
D3DKMTPresent
CreateRectRgn
D3DKMTGetContextSchedulingPriority
D3DKMTGetScanLine
D3DKMTSetQueuedLimit
D3DKMTCheckOcclusion
D3DKMTCheckMonitorPowerState
D3DKMTCheckExclusiveOwnership
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTSharedPrimaryLockNotification
D3DKMTSharedPrimaryUnLockNotification
D3DKMTReleaseProcessVidPnSourceOwners
D3DKMTCreateOverlay
D3DKMTUpdateOverlay
D3DKMTFlipOverlay
D3DKMTDestroyOverlay
D3DKMTConfigureSharedResource
D3DKMTQueryStatistics
D3DKMTGetOverlayState
SetLayout
SetStretchBltMode
StretchBlt
CreateCompatibleDC
CreateDIBSection
SelectObject
GetDeviceGammaRamp
GdiEntry1
GdiEntry13
CreateCompatibleBitmap
GetDIBits
GetRandomRgn
DeleteObject
GetRegionData
CreateDCA
GetNearestColor
GetDeviceCaps
DeleteDC
BitBlt

kernel32

GetProcessAffinityMask
ReleaseMutex
WaitForSingleObject
InterlockedIncrement
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
InterlockedExchange
SetErrorMode
InterlockedDecrement
OutputDebugStringA
GetNativeSystemInfo
GetModuleFileNameA
FreeLibraryAndExitThread
CloseHandle
DisableThreadLibraryCalls
GetCurrentProcessId
LocalFree
CreateEventExA
CreateSemaphoreExA
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
VerifyVersionInfoA
GetCurrentThread
SetThreadAffinityMask
SetThreadPriority
ResumeThread
SetThreadIdealProcessor
GetEnvironmentVariableA
TlsAlloc
TlsGetValue
TlsSetValue
lstrlenA
VirtualProtect
GetSystemInfo
VirtualAlloc
VirtualFree
WaitForMultipleObjects
CreateEventA
CreateThread
SetEvent
GetLogicalProcessorInformation
GetVersionExA
MultiByteToWideChar
IsProcessorFeaturePresent
GetFileSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
CreateNamedPipeA
CreateFileA
WaitNamedPipeA
TransactNamedPipe
GetPrivateProfileStringA
PeekNamedPipe
WriteFile
ReadFile
FlushFileBuffers
DisconnectNamedPipe
SetNamedPipeHandleState
ConnectNamedPipe
CreateMutexW
OpenMutexW
GetProcessHeap
ResetEvent
GlobalAddAtomA
lstrcmpA
CreateSemaphoreA
LoadLibraryW
GetSystemTime
ReleaseSemaphore
GetProcessId
LocalAlloc
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
InterlockedCompareExchange
GetModuleHandleA
DebugBreak
GetCurrentProcess
OutputDebugStringW
WideCharToMultiByte
GetLastError

dwmapi

ord126
ord125
ord100
ord101
ord128
ord129
ord130

Exports

Exports

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
DebugSetLevel
DebugSetMute
Direct3DCreate9
Direct3DCreate9Ex
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0645f8b8ef977aa10f9cbb25803a746

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

version

d3d8thk

gdi32

kernel32

dwmapi

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 29KB - Virtual size: 38KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 59KB - Virtual size: 58KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 29KB - Virtual size: 38KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 59KB - Virtual size: 58KB