xinput1_3[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xinput1_3.dll
Size 104KB
Sample260718-cdc7fsgt2t
SHA256 756cad002e1553cfa1a91ebe8c1b9380ffabe0b4b1916c4a4db802396ddfbef8
MD5 bfb3091b167550ec6e6454813d3db244
SHA1 87e86a7c783f607697a4880e7e063ab87bf63034
SHA512 ce2ead2480a3942081af4df4baee32de18862b5f0288169b9e8135cc710eb128f9a2b8a36bda87212c53fd4317359349c94d38b5da082638230dcb5669efede9
SSDEEP 1536:S1ea+pg4i1fprOwSGiExJ70MBzLrPbYMGsJ0OXrLSkfmrxy/Fae:S1nz1UrGiEPg0LH7GNO7LSkfaxy/E
TLSH
T15DA3299AF25991F9D47BC07886D3BB26F6B2B450073487CB2764466A0F13BD89E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
xinput1_3.dll

File Explorer

xinput1_3.dll

.dll 104KB

xinput1_3.dll

IMPHASH cfb6d24996ee7fd94a9861f495966a8f
SHA256 756cad002e1553cfa1a91ebe8c1b9380ffabe0b4b1916c4a4db802396ddfbef8
MD5 bfb3091b167550ec6e6454813d3db244
SHA1 87e86a7c783f607697a4880e7e063ab87bf63034
SHA512 ce2ead2480a3942081af4df4baee32de18862b5f0288169b9e8135cc710eb128f9a2b8a36bda87212c53fd4317359349c94d38b5da082638230dcb5669efede9
SSDEEP 1536:S1ea+pg4i1fprOwSGiExJ70MBzLrPbYMGsJ0OXrLSkfmrxy/Fae:S1nz1UrGiEPg0LH7GNO7LSkfaxy/E
TLSH
T15DA3299AF25991F9D47BC07886D3BB26F6B2B450073487CB2764466A0F13BD89E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b1:13:a0:12:c8:ac:fe:2a:cf:9b:de:3a:9a:57:d2:44:15:68:d9:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 5, 2007

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:47:52:ba:00:00:00:00:00:04

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:49:7c:ed:00:00:00:00:00:05

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

39136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

XInput1_3.pdb

ntdll

RtlPcToFileHeader RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

LeaveCriticalSection LocalFree DuplicateHandle GetCurrentProcess LocalAlloc SetEvent GetLastError CreateThread CreateFileW LoadLibraryW FreeLibrary GetProcAddress DeviceIoControl GetOverlappedResult CreateEventW GetTickCount QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap ExitProcess GetModuleHandleA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue Sleep HeapSetInformation HeapCreate HeapDestroy EnterCriticalSection GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA DeleteCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW WriteFile RaiseException GetACP GetOEMCP GetCPInfo LoadLibraryA IsBadReadPtr IsBadWritePtr IsBadCodePtr SetFilePointer MultiByteToWideChar GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery FlushFileBuffers InitializeCriticalSection CloseHandle SetHandleCount GetEnvironmentStrings

advapi32

TraceMessage

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

Sharing

General

Malware Config

Signatures

File Explorer

xinput1_3.dll

PE Signature issue

ntdll

kernel32

advapi32

setupapi

generic