D3D12[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

D3D12.dll
Size

1.4MB
MD5

e7f0fee6a8c3740ab49b1b471d08dded
SHA1

241f440555d7ff62525f44eef7d1e7a345953d35
SHA256

f7777f44ef8b3f90cbdc593f8e046803b0bbc60426480737af1045617afb2dd5
SHA512

3778de0e6c8ce7b81f9bc29fc270ab51287dfcd845494bf2e2caaa9cdaed722b995057a21b6135697484f85867a4dcc6f63370793bf2a0c8e40d94e7bdf0b2be
SSDEEP

24576:JWSk80f9RHNVlO9KRemiYdKcN9LysgkdrresvAsdUxxIYOD+H0Ce0fO05f:JWSk80fHtVvHdKcNJyAxvASMxAD+UCey

Score

1^/10

Malware Config

Signatures

Files

D3D12.dll
.dll windows:10 windows x86 arch:x86

011b4a6735624619eb2b0967cce90e34

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:b1:00:7c:a7:2a:c2:1d:9b:ba:7a:d9:c7:3f:9d:96:4e:e3:1b:7b:86:0f:20:f1:73:fb:83:29:3b:48:00:a7
Signer

Actual PE Digest

d4:b1:00:7c:a7:2a:c2:1d:9b:ba:7a:d9:c7:3f:9d:96:4e:e3:1b:7b:86:0f:20:f1:73:fb:83:29:3b:48:00:a7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d12.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o_atoi
_o_free
_o_isdigit
_o_malloc
_o_mbstowcs_s
_o_terminate
_o_tolower
_o_wcscpy_s
__CxxFrameHandler3
__std_terminate
memchr
__std_type_info_compare
wcsstr
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__crt_atexit
_o__configure_narrow_argv
memcmp
memcpy

ntdll

NtQuerySection
EtwEventUnregister
EtwEventSetInformation
EtwEventRegister
RtlIsCriticalSectionLockedByThread
RtlInitUnicodeString
RtlCaptureStackBackTrace
NtQueryObject
EtwEventWriteTransfer

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-synch-l1-1-0

CreateMutexExW
SetEvent
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSemaphore
CreateSemaphoreExW
InitializeSRWLock
SetCriticalSectionSpinCount
ResetEvent
CreateEventA
WaitForSingleObjectEx
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExA
FreeLibrary
GetModuleFileNameA

api-ms-win-core-heap-l2-1-0

LocalFree

dxgi

CreateDXGIFactory2

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
VirtualProtect
VirtualFree
VirtualAlloc
VirtualQuery

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExA
RegGetValueW
RegCloseKey
RegEnumKeyExA
RegSetValueExW

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTOpenSynchronizationObject
D3DKMTCreateKeyedMutex2
D3DKMTDestroyKeyedMutex
D3DKMTOpenKeyedMutex2
D3DKMTDestroyContext
D3DKMTQueryAdapterInfo
D3DKMTGetMultisampleMethodList
D3DKMTCreateDevice
D3DKMTPresent
D3DKMTDestroyDevice
D3DKMTEscape
D3DKMTCreateAllocation2
D3DKMTSetQueuedLimit
D3DKMTGetDeviceState
D3DKMTShareObjects
D3DKMTOpenNtHandleFromName
D3DKMTQueryResourceInfoFromNtHandle
D3DKMTQueryResourceInfo
D3DKMTOpenResourceFromNtHandle
D3DKMTOpenResource
D3DKMTDestroyAllocation
D3DKMTDestroySynchronizationObject
D3DKMTSetAllocationPriority
D3DKMTQueryAllocationResidency
D3DKMTAcquireKeyedMutex2
D3DKMTReleaseKeyedMutex2
D3DKMTSetContextSchedulingPriority
D3DKMTRender
D3DKMTLock
D3DKMTUnlock
D3DKMTCreateContext
D3DKMTCreateSynchronizationObject
D3DKMTCreateSynchronizationObject2
D3DKMTWaitForSynchronizationObject
D3DKMTWaitForSynchronizationObject2
D3DKMTSignalSynchronizationObject
D3DKMTSignalSynchronizationObject2
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTOfferAllocations

api-ms-win-dx-d3dkmt-l1-1-2

D3DKMTDestroyHwQueue
D3DKMTSubmitCommandToHwQueue
D3DKMTCreateHwQueue
D3DKMTSubmitWaitForSyncObjectsToHwQueue
D3DKMTSubmitSignalSyncObjectsToHwQueue

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-base-l1-1-0

PrivilegeCheck

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-dx-d3dkmt-l1-1-1

D3DKMTEvict
D3DKMTMakeResident
D3DKMTSetStablePowerState
D3DKMTWaitForSynchronizationObjectFromCpu
D3DKMTCreateContextVirtual
D3DKMTSubmitCommand
D3DKMTMarkDeviceAsError
D3DKMTUpdateAllocationProperty
D3DKMTUpdateGpuVirtualAddress
D3DKMTOpenSyncObjectFromNtHandle2
D3DKMTReclaimAllocations2
D3DKMTFreeGpuVirtualAddress
D3DKMTReserveGpuVirtualAddress
D3DKMTMapGpuVirtualAddress
D3DKMTInvalidateCache
D3DKMTSignalSynchronizationObjectFromCpu
D3DKMTWaitForSynchronizationObjectFromGpu
D3DKMTSignalSynchronizationObjectFromGpu
D3DKMTUnlock2
D3DKMTDestroyAllocation2
D3DKMTOpenSyncObjectNtHandleFromName
D3DKMTQueryClockCalibration
D3DKMTLock2
D3DKMTSignalSynchronizationObjectFromGpu2
D3DKMTCreatePagingQueue
D3DKMTDestroyPagingQueue

api-ms-win-dx-d3dkmt-l1-1-3

D3DKMTGetAllocationPriority

api-ms-win-dx-d3dkmt-l1-1-4

D3DKMTSetContextInProcessSchedulingPriority
D3DKMTOpenProtectedSessionFromNtHandle
D3DKMTCreateBundleObject
D3DKMTDestroyTrackedWorkload
D3DKMTExtractBundleObject
D3DKMTQueryProtectedSessionInfoFromNtHandle
D3DKMTGetTrackedWorkloadStatistics
D3DKMTCreateProtectedSession
D3DKMTResetTrackedWorkload
D3DKMTQueryProtectedSessionStatus
D3DKMTDestroyProtectedSession
D3DKMTGetAvailableTrackedWorkloadIndex
D3DKMTCreateTrackedWorkload
D3DKMTEndTrackedWorkload
D3DKMTUpdateTrackedWorkload
D3DKMTSubmitPresentToHwQueue
D3DKMTOpenBundleObjectNtHandleFromName

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-memory-l1-1-1

GetWriteWatch

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-file-l1-1-0

CreateFileA
GetFileTime
CreateFileW
GetFileSize

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

kernelbase

BaseFormatObjectAttributes

api-ms-win-crt-math-l1-1-0

_isnan

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-ntuser-rectangle-l1-1-0

IsRectEmpty

Exports

Exports

D3D12CoreCreateLayeredDevice
D3D12CoreGetLayeredDeviceSize
D3D12CoreRegisterLayers
D3D12CreateDevice
D3D12CreateRootSignatureDeserializer
D3D12CreateVersionedRootSignatureDeserializer
D3D12DeviceRemovedExtendedData
D3D12EnableExperimentalFeatures
D3D12GetDebugInterface
D3D12PIXEventsReplaceBlock
D3D12PIXGetThreadInfo
D3D12PIXNotifyWakeFromFenceSignal
D3D12PIXReportCounter
D3D12SerializeRootSignature
D3D12SerializeVersionedRootSignature
GetBehaviorValue
SetAppCompatStringPointer

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text_hf
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DDIData
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

011b4a6735624619eb2b0967cce90e34

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

d4:b1:00:7c:a7:2a:c2:1d:9b:ba:7a:d9:c7:3f:9d:96:4e:e3:1b:7b:86:0f:20:f1:73:fb:83:29:3b:48:00:a7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l2-1-0

dxgi

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-2

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-1

api-ms-win-dx-d3dkmt-l1-1-3

api-ms-win-dx-d3dkmt-l1-1-4

api-ms-win-core-com-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-interlocked-l1-1-0

kernelbase

api-ms-win-crt-math-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.text_hf Size: 143KB - Virtual size: 143KB

.data Size: 14KB - Virtual size: 39KB

.idata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 84B

.DDIData Size: 512B - Virtual size: 4B

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 55KB - Virtual size: 54KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

d4:b1:00:7c:a7:2a:c2:1d:9b:ba:7a:d9:c7:3f:9d:96:4e:e3:1b:7b:86:0f:20:f1:73:fb:83:29:3b:48:00:a7
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.text_hf
Size: 143KB - Virtual size: 143KB

.data
Size: 14KB - Virtual size: 39KB

.idata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 84B

.DDIData
Size: 512B - Virtual size: 4B

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 55KB - Virtual size: 54KB