d3dref9[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3dref9.dll
Size

17.2MB
MD5

56ae3df28fa5d841734b2e321fdb9524
SHA1

df4e08b2bbb50d9f84f44829a6f839260b8e6d73
SHA256

4f3cd64e94280d618cd1c4ac8e1892a73efcb6eefa49dd93df417341b20ae17a
SHA512

95c32de24c6999d09149bcd2a01a706c113b37223e1335090c3d93d3778990089e60e259eaf3cc535cd3a210b980c9e928983fc2e59634009d5410a3e826027a
SSDEEP

393216:kP9pSa7OliPX4iThHAu0REtLv6E1tqwHPiuOQ4rI/Lu:K9pNOlco8hHAu0Rav6AqwviuObE/y

Score

1^/10

Malware Config

Signatures

Files

d3dref9.dll
.dll windows:6 windows x86 arch:x86

4022ae881fc1fa42ce7198f724f2deb9

Code Sign

06:68:33:53:84:7b:85:8e:42:8b:41:44:ee:46:89:6d
Certificate

Issuer

CN=MaldevHax

Not Before

20/08/2024, 23:20

Not After

21/02/2033, 21:00

Subject

CN=MaldevHax

Extended Key Usages

ExtKeyUsageCodeSigning

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:68:33:53:84:7b:85:8e:42:8b:41:44:ee:46:89:6d
Certificate

Issuer

CN=MaldevHax

Not Before

20/08/2024, 23:20

Not After

21/02/2033, 21:00

Subject

CN=MaldevHax

Extended Key Usages

ExtKeyUsageCodeSigning

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:11:5d:d2:2a:23:e1:fd:d8:c2:64:93:af:6a:df:23:5f:b0:61:03:21:f0:2f:a4:a3:88:4e:c1:58:84:2d:12
Signer

Actual PE Digest

c1:11:5d:d2:2a:23:e1:fd:d8:c2:64:93:af:6a:df:23:5f:b0:61:03:21:f0:2f:a4:a3:88:4e:c1:58:84:2d:12

Digest Algorithm

sha256

PE Digest Matches

true

66:6e:a5:87:70:4c:ff:52:c3:3f:7e:e9:11:9d:b4:5f:d6:f0:eb:66
Signer

Actual PE Digest

66:6e:a5:87:70:4c:ff:52:c3:3f:7e:e9:11:9d:b4:5f:d6:f0:eb:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualQuery
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindow

gdi32

DeleteObject

advapi32

RegSetValueExA

shell32

ShellExecuteA

wintrust

WinVerifyTrust

urlmon

URLDownloadToFileA

iphlpapi

GetExtendedTcpTable

ntdll

RtlImageNtHeader

shlwapi

ord12

ws2_32

connect

gdiplus

GdipCreateBitmapFromHBITMAP

d3d9

Direct3DCreate9

bcrypt

BCryptGenRandom

crypt32

PFXImportCertStore

Sections

KG@a4@;9
Size: - Virtual size: 908KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

xHI2$X$E
Size: - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Ku^*(5b?
Size: - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1yG2>%c
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

uQ`wFRf;
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Zzn]mMEI
Size: - Virtual size: 11.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PGEcZb2`
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

XJg.)J&R
Size: 17.2MB - Virtual size: 17.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

QqExulj#
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4022ae881fc1fa42ce7198f724f2deb9

Code Sign

06:68:33:53:84:7b:85:8e:42:8b:41:44:ee:46:89:6dCertificate

Extended Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

06:68:33:53:84:7b:85:8e:42:8b:41:44:ee:46:89:6dCertificate

Extended Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

c1:11:5d:d2:2a:23:e1:fd:d8:c2:64:93:af:6a:df:23:5f:b0:61:03:21:f0:2f:a4:a3:88:4e:c1:58:84:2d:12Signer

66:6e:a5:87:70:4c:ff:52:c3:3f:7e:e9:11:9d:b4:5f:d6:f0:eb:66Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wintrust

urlmon

iphlpapi

ntdll

shlwapi

ws2_32

gdiplus

d3d9

bcrypt

crypt32

Sections

KG@a4@;9 Size: - Virtual size: 908KB

xHI2$X$E Size: - Virtual size: 157KB

Ku^*(5b? Size: - Virtual size: 232KB

t1yG2>%c Size: - Virtual size: 4KB

uQ`wFRf; Size: - Virtual size: 12B

Zzn]mMEI Size: - Virtual size: 11.7MB

PGEcZb2` Size: 2KB - Virtual size: 2KB

XJg.)J&R Size: 17.2MB - Virtual size: 17.2MB

QqExulj# Size: 2KB - Virtual size: 2KB

06:68:33:53:84:7b:85:8e:42:8b:41:44:ee:46:89:6d
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

06:68:33:53:84:7b:85:8e:42:8b:41:44:ee:46:89:6d
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

c1:11:5d:d2:2a:23:e1:fd:d8:c2:64:93:af:6a:df:23:5f:b0:61:03:21:f0:2f:a4:a3:88:4e:c1:58:84:2d:12
Signer

66:6e:a5:87:70:4c:ff:52:c3:3f:7e:e9:11:9d:b4:5f:d6:f0:eb:66
Signer

KG@a4@;9
Size: - Virtual size: 908KB

xHI2$X$E
Size: - Virtual size: 157KB

Ku^*(5b?
Size: - Virtual size: 232KB

t1yG2>%c
Size: - Virtual size: 4KB

uQ`wFRf;
Size: - Virtual size: 12B

Zzn]mMEI
Size: - Virtual size: 11.7MB

PGEcZb2`
Size: 2KB - Virtual size: 2KB

XJg.)J&R
Size: 17.2MB - Virtual size: 17.2MB

QqExulj#
Size: 2KB - Virtual size: 2KB