d3d11[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3d11.dll
Size

1.8MB
MD5

dc4d92471cc079d2dad1919550d849ce
SHA1

a1664e3a3f07ee4503fab6f6ef4e7866f8e6f03a
SHA256

246544993d39bc76f40d7fff83c189aa4a9c8c6eddfb1724dbed6ec06c9938c4
SHA512

fb29703d207814b02ae2cb3c3ceed6584f40b4bd07090dcd324baf83ca53bd9e2b3f151bbb74419f6375cac0e26cba7609b2d445b628736a2d8a75ca5f684ce2
SSDEEP

24576:Wrt5bKLdpezFmoqsRHhRdnqWHapPWMIpicUDhhh0lhSMXlK+5IxUn2gV0QEVpLp5:cnboEHdnqwa5WMIuDhohiTF8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3d11.dll

Files

d3d11.dll
.dll windows:6 windows x64 arch:x64

58bcea587c5adb29f6811cc9008d4755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\ianco\Desktop\Important Desktop Files\Complete Clients\project-bo4\build\bin\x64\Release\d3d11.pdb

Imports

kernel32

GetSystemDirectoryA
InitializeCriticalSectionEx
GetLastError
DecodePointer
DeleteCriticalSection
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
IsBadReadPtr
SetThreadContext
GetThreadContext
HeapDestroy
HeapCreate
GetCurrentThreadId
CreateFileMappingW
GetCurrentProcessId
GetSystemInfo
InitializeCriticalSection
GetProcAddress
CreateMutexExA
GetTickCount
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
UnmapViewOfFile
OutputDebugStringA
CreateThread
GetCurrentProcess
MapViewOfFile
HeapSize
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
HeapReAlloc
GetFileType
GetStdHandle
HeapAlloc
HeapFree
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleFileNameA
SizeofResource
VirtualProtect
FindResourceA
GetModuleHandleA
GetCommandLineA
GetModuleHandleExA
LoadLibraryA
LockResource
CloseHandle
LoadResource
FreeLibrary
VirtualFree
VirtualAlloc
FlushInstructionCache
GlobalLock
GlobalUnlock
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadId
OpenThread
ReadFile
SetFilePointer
GetTempPathA
CreateFileA
GetTempFileNameA
FlushFileBuffers
VirtualQuery
DeleteFileA
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetNativeSystemInfo
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
FormatMessageA
LocalFree
GetLocaleInfoEx
InitOnceBeginInitialize
InitOnceComplete
SetLastError
LoadLibraryExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetDateFormatW
GetTimeFormatW
TerminateProcess

user32

GetWindowTextA
ShowCursor
GetAsyncKeyState
IsWindow
ShowWindow
DestroyWindow
MessageBoxA
LoadIconA
LoadCursorA
RegisterClassA
GetSystemMetrics
CreateWindowExA
OpenClipboard
CloseClipboard
GetWindowTextW
DefWindowProcA
GetClipboardData
UnregisterClassA
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
UpdateWindow
SetWindowPos
AdjustWindowRect
GetWindowRect
SendMessageA

gdi32

CreateBitmap
DeleteObject

advapi32

CryptAcquireContextW
RegOpenKeyExW
RegCloseKey
GetUserNameA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

shell32

ShellExecuteA

ws2_32

getaddrinfo
freeaddrinfo
getpeername
getsockname
gethostbyname
connect
closesocket
send
WSASetLastError
recv
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket

dbghelp

MiniDumpWriteDump

Exports

Exports

D3D11CreateDevice

Sections

.text
Size: 981KB - Virtual size: 980KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 564KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58bcea587c5adb29f6811cc9008d4755

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

dbghelp

Exports

Exports

Sections

.text Size: 981KB - Virtual size: 980KB

.rdata Size: 564KB - Virtual size: 564KB

.data Size: 24KB - Virtual size: 67KB

.pdata Size: 48KB - Virtual size: 47KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 248KB - Virtual size: 248KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 981KB - Virtual size: 980KB

.rdata
Size: 564KB - Virtual size: 564KB

.data
Size: 24KB - Virtual size: 67KB

.pdata
Size: 48KB - Virtual size: 47KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 248KB - Virtual size: 248KB

.reloc
Size: 6KB - Virtual size: 5KB