d3dcompiler_47[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
d3dcompiler_47.dll
Size 3.3MB
Sample260723-qvgsvsbb93
SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
MD5 c5b362bce86bb0ad3149c4540201331d
SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
TLSH
T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

d3dcompiler_47.dll

.dll 3.3MB

d3dcompiler_47.dll

IMPHASH f63cad154afed6da772d0ab361f448f6
SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
MD5 c5b362bce86bb0ad3149c4540201331d
SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
TLSH
T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ab:69:30:eb:d8:d5:6c:83:dd:de:d2:5c:78:4a:69:da:61:fc:c5:96:29:e5:ab:ad:9d:48:a5:e2:d1:66:17:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 22, 2013

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

69:26:3d:60:06:7a:72:dd:e2:38:44:52:38:d1:d7:f8:7e:61:16:0d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 22, 2013

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 4, 2012 - Dec 4, 2013

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 30, 2012 - Nov 30, 2013

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:29:97:4e:7c:82:cb:20:16:41:00:00:00:00:00:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

Major OS version

Entry point

3204919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47.pdb

msvcrt

_onexit __dllonexit _unlock _lock ?terminate@@YAXXZ ??1type_info@@UAE@XZ _initterm _amsg_exit _XcptFilter _strtoui64 sscanf _isnan _vsnprintf strtoul isxdigit atof setlocale _strdup _mbstrlen _vsnwprintf strnlen ceil modf strrchr strncpy_s memcpy_s isalnum _finite _clearfp _controlfp strcpy_s malloc _strnicmp _fpclass strncmp isspace strstr strchr free sprintf_s _stricmp _purecall memmove qsort isalpha toupper atoi _except_handler4_common tolower ??2@YAPAXI@Z getenv ??3@YAXPAX@Z wcsncmp wcsncpy_s _wcsicmp memcpy memset fclose strcat_s bsearch _CxxThrowException _snwprintf_s wcschr iswdigit __unDName fread fseek _wfsopen vsprintf_s wcstol _wcsnicmp _wsplitpath_s towlower wcscpy_s ??_U@YAPAXI@Z ??_V@YAXPAX@Z swprintf_s wcsncat_s wcsrchr _wmakepath_s time _wfullpath _wcsdup _wgetenv _chsize _close _read _write _lseeki64 _get_osfhandle _open_osfhandle wcscat_s ftell _mbscmp _memicmp isdigit _wsopen _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh __CxxFrameHandler3 _ftol2 _ftol2_sse floor

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegOpenKeyExW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegQueryValueExW

kernel32

SetLastError LocalFree LocalAlloc GetVersion InterlockedDecrement InterlockedIncrement GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetFileSize GetSystemInfo VirtualAlloc VirtualFree GetProcAddress LoadLibraryExW GetEnvironmentVariableA GetFullPathNameA GetFullPathNameW TlsFree TlsGetValue TlsSetValue TlsAlloc Sleep HeapFree GetFileAttributesW SetFileAttributesW CopyFileExW DeleteFileW GetFileType DeviceIoControl ExpandEnvironmentStringsW InitializeCriticalSectionAndSpinCount SetFilePointer FlushViewOfFile MapViewOfFileEx GetModuleFileNameA CreateFileA DisableThreadLibraryCalls CreateFileW GetLastError GetFileSizeEx ReadFile CloseHandle WriteFile WideCharToMultiByte FreeLibrary lstrcmpiA MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter HeapCreate HeapDestroy InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc GetProcessHeap

rpcrt4

UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

d3dcompiler_47.dll

PE Signature issue

msvcrt

advapi32

kernel32

rpcrt4

generic