dplayx[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dplayx.dll
Size

1.3MB
MD5

8fa338653d1fa59c45d3d91f54dafccc
SHA1

f99cf3f044ac3db708ca948c15c353413019ae2a
SHA256

d405d0290dab1fd3ecf3ac485b48815784b2016ba10345092c15a7f0eea11847
SHA512

e0a145665457a1282eadae45f1fed88a6933892f03ed44e87497878fbb9052cf14f3ba45afd9ce9e6839a1e1238e39dc5b3e5025244088f6223ce35b6ea2414e
SSDEEP

12288:XRuoUDIhnhQI+rIC34ukXzVhE2C/TJ6jnRr:XRuoUDzdkBd86jnRr

Score

1^/10

Malware Config

Signatures

Files

dplayx.dll
.dll regsvr32 windows x64

9e24199a09c2311acd3d5abfca1447e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW

kernel32

CloseHandle
CreateEventW
CreateFileMappingA
CreateProcessA
CreateSemaphoreA
CreateThread
DebugBreak
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FlushViewOfFile
FreeLibrary
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
MapViewOfFile
MapViewOfFileEx
MultiByteToWideChar
ReleaseSemaphore
ResumeThread
SetEvent
SizeofResource
SleepEx
TerminateThread
UnmapViewOfFile
WaitForSingleObject
WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromString
CoCreateGuid

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_strdup
free
fwrite
getenv
memcmp
memcpy
memmove
memset
strchr
strcmp
strcpy
strcspn
strlen

user32

GetMessageW
wsprintfA

winmm

timeGetTime

Exports

Exports

DirectPlayCreate
DirectPlayEnumerate
DirectPlayEnumerateA
DirectPlayEnumerateW
DirectPlayLobbyCreateA
DirectPlayLobbyCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
gdwDPlaySPRefCount

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 432B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 488KB - Virtual size: 485KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 304KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e24199a09c2311acd3d5abfca1447e1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

ucrtbase

user32

winmm

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.data Size: 4KB - Virtual size: 288B

.rodata Size: 4KB - Virtual size: 52B

.rdata Size: 60KB - Virtual size: 56KB

.pdata Size: 8KB - Virtual size: 6KB

.xdata Size: 8KB - Virtual size: 5KB

.bss Size: - Virtual size: 432B

.edata Size: 64KB - Virtual size: 60KB

.idata Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 1000B

/4 Size: 4KB - Virtual size: 704B

/19 Size: 488KB - Virtual size: 485KB

/31 Size: 16KB - Virtual size: 15KB

/45 Size: 80KB - Virtual size: 78KB

/57 Size: 40KB - Virtual size: 39KB

/70 Size: 16KB - Virtual size: 13KB

/81 Size: 304KB - Virtual size: 302KB

/92 Size: 28KB - Virtual size: 24KB

.text
Size: 92KB - Virtual size: 91KB

.data
Size: 4KB - Virtual size: 288B

.rodata
Size: 4KB - Virtual size: 52B

.rdata
Size: 60KB - Virtual size: 56KB

.pdata
Size: 8KB - Virtual size: 6KB

.xdata
Size: 8KB - Virtual size: 5KB

.bss
Size: - Virtual size: 432B

.edata
Size: 64KB - Virtual size: 60KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 1000B

/4
Size: 4KB - Virtual size: 704B

/19
Size: 488KB - Virtual size: 485KB

/31
Size: 16KB - Virtual size: 15KB

/45
Size: 80KB - Virtual size: 78KB

/57
Size: 40KB - Virtual size: 39KB

/70
Size: 16KB - Virtual size: 13KB

/81
Size: 304KB - Virtual size: 302KB

/92
Size: 28KB - Virtual size: 24KB