d3d9[.]dll | Triage™

General

Target
d3d9.dll
Size 167KB
Sample261027-2z72dsxtgx
SHA256 0b73c1b2261f30f742b46f9ed8dd07132b4fbbd70f85efdef86f7949769468d2
MD5 57027f9d0c42152ddc20273309e89322
SHA1 dde8fc249f4653b545e9b2a182ad45a81fcc7a29
SHA512 87f4259b4baff3009fca03e1be8021f4e8dbfaf6be443d4158702249a3123b08c37cfdd55b5364f791be6b9a3f58c538de248647a185473008753e1bb9e3689b
SSDEEP 3072:5z71U1PFp8gEKpxlm6R8YXYehhnGm5x6zMnaWahNsFvo9bnqGdrCCb:ObTEOxlvVIMhG7zMnLaSO7r8C
TLSH
T1D6F38E007580C032FBBF213D4874AF369A2EB5645B94EDDF6B445D9A6BB02C18B325E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3d9.dll

File Explorer

d3d9.dll

.dll 167KB

d3d9.dll

IMPHASH 44f4a48094a2da73c458c7c89d4f2a95
SHA256 0b73c1b2261f30f742b46f9ed8dd07132b4fbbd70f85efdef86f7949769468d2
MD5 57027f9d0c42152ddc20273309e89322
SHA1 dde8fc249f4653b545e9b2a182ad45a81fcc7a29
SHA512 87f4259b4baff3009fca03e1be8021f4e8dbfaf6be443d4158702249a3123b08c37cfdd55b5364f791be6b9a3f58c538de248647a185473008753e1bb9e3689b
SSDEEP 3072:5z71U1PFp8gEKpxlm6R8YXYehhnGm5x6zMnaWahNsFvo9bnqGdrCCb:ObTEOxlvVIMhG7zMnLaSO7r8C
TLSH
T1D6F38E007580C032FBBF213D4874AF369A2EB5645B94EDDF6B445D9A6BB02C18B325E7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

47657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\d3d9-wrapper\data\d3d9.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentProcessId GetCurrentThreadId GetSystemDirectoryA GetSystemWindowsDirectoryA VirtualProtect FreeLibrary GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA lstrcmpA lstrcmpiA lstrcmpiW GetPrivateProfileIntA CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers HeapReAlloc HeapSize SetStdHandle SetFilePointerEx GetStringTypeW GetProcessHeap LCMapStringW InitializeCriticalSectionEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlUnwind InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW DecodePointer HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree WriteConsoleW

user32

DefWindowProcA DefWindowProcW IsWindow SetWindowPos GetAncestor GetMonitorInfoA MonitorFromWindow EnumDisplayDevicesA EnumDisplaySettingsA GetWindowThreadProcessId GetDesktopWindow GetClassWord SetWindowLongA GetWindowLongA ClipCursor GetWindowRect GetClientRect IsWindowUnicode SetCapture

d3dx9_43

D3DXCreateFontIndirectA

winmm

timeBeginPeriod timeEndPeriod

Name

.text

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d3d9.dll

kernel32

user32

d3dx9_43

winmm

generic