D3D12[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

D3D12.dll
Size

787KB
MD5

26cd81f3e2fc069d38a072e94307d1bf
SHA1

959ccfbd2b83cd95866597e6cc4b6b54dd731030
SHA256

382f8a4723f7c7384e2568f88f80e13c4086cc470cb913315e75980e206b7714
SHA512

fc414a5fdd74f76c65d2b6babe45fdf8ab28d9d967466e998da876cffca64d5b5b79407e24fc42b7213a1e2a607db7502dc824a42affe6c9faf435f3baed307e
SSDEEP

24576:gSK0SlxwX8vClKEQ7dk6ajo4BWf8FMwGqhI/rOa2gn:gSK0SlY8qLQeFYj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
D3D12.dll

Files

D3D12.dll
.dll windows:10 windows x86 arch:x86

2e7f526bc9f622b43d336b2cb329c429

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d12.pdb

Imports

msvcp110_win

??0_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Xbad_function_call@std@@YAXXZ
??0id@locale@std@@QAE@I@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z

msvcrt

malloc
memcmp
_ftol2_sse
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
_vsnprintf
memmove
_purecall
time
_vsnwprintf
_stricmp
_except_handler4_common
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
memcpy
tolower
isdigit
memset
memchr
atoi
free

ntdll

RtlCaptureStackBackTrace
EtwEventRegister
EtwEventSetInformation
EtwEventWriteTransfer
EtwEventUnregister
EtwEventWrite
EtwEventActivityIdControl
RtlIsCriticalSectionLockedByThread
RtlInitUnicodeString
WinSqmIsOptedIn
WinSqmAddToStreamEx
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentProcessId
GetProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
GetSystemDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
OutputDebugStringA

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-synch-l1-2-0

InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
Sleep
SetCriticalSectionSpinCount
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ResetEvent
TryEnterCriticalSection
CreateEventA
SetEvent
InitializeSRWLock

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleExA
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-heap-l2-1-0

LocalFree

dxgi

CreateDXGIFactory2

api-ms-win-core-memory-l1-1-2

VirtualProtect
VirtualAlloc
VirtualFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegOpenKeyExA
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExA
RegSetValueExW
RegCloseKey
RegEnumKeyExA

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayDevicesW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-file-l1-2-1

GetFileTime
CreateFileW
GetFileSize
CreateFileA

api-ms-win-dx-d3dkmt-l1-1-0

GdiEntry13

api-ms-win-core-com-l1-1-1

CLSIDFromString

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowThreadProcessId

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-util-l1-1-0

EncodePointer

kernelbase

BaseFormatObjectAttributes

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

D3D12CoreCreateLayeredDevice
D3D12CoreGetLayeredDeviceSize
D3D12CoreRegisterLayers
D3D12CreateDevice
D3D12CreateRootSignatureDeserializer
D3D12CreateVersionedRootSignatureDeserializer
D3D12GetDebugInterface
D3D12SerializeRootSignature
D3D12SerializeVersionedRootSignature
GetBehaviorValue
SetAppCompatStringPointer

Sections

.text
Size: 602KB - Virtual size: 602KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text_hf
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DDIData
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e7f526bc9f622b43d336b2cb329c429

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

ntdll

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l2-1-0

dxgi

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-quirks-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

kernelbase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 602KB - Virtual size: 602KB

.text_hf Size: 94KB - Virtual size: 94KB

.data Size: 4KB - Virtual size: 27KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.DDIData Size: 512B - Virtual size: 4B

.rsrc Size: 49KB - Virtual size: 48KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 602KB - Virtual size: 602KB

.text_hf
Size: 94KB - Virtual size: 94KB

.data
Size: 4KB - Virtual size: 27KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.DDIData
Size: 512B - Virtual size: 4B

.rsrc
Size: 49KB - Virtual size: 48KB

.reloc
Size: 29KB - Virtual size: 29KB