Static task
static1
Behavioral task
behavioral1
Sample
DXCap.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DXCap.exe
Resource
win10v2004-20230221-en
General
-
Target
DXCap.exe
-
Size
892KB
-
MD5
fe838f34b45b1c6b4fcee0e7958dd8d0
-
SHA1
842baee4c2bca1051a01290625ac05de8842a9dc
-
SHA256
c824d0cbc4ddfb926092480aff437189300e4dfc4184a55811a0e97e77477a70
-
SHA512
ebf6a7e216913832dc0231a4c37ee454dc1e7adc3663296f8a1b2d6d925b034b010634f20d59cf056fe848b829e2b7fc2483a2d8a83d65ddb96b7a90220fcdb9
-
SSDEEP
12288:6i5+ZlsF0Rht2dS1QuHSuclLtpG4hyCJkDn7Q9KiiXuD4L9B5jEDthQ:J6lsFAodaQuHSuL4UC87oiJD5jEDt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DXCap.exe
Files
-
DXCap.exe.exe windows x86
7f6984f56e99452cf7c9e9862edf0b28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
api-ms-win-crt-math-l1-1-0
_isnan
api-ms-win-crt-string-l1-1-0
memset
strcspn
__strncnt
wcsnlen
strnlen
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__fseeki64
_o__get_initial_narrow_environment
_o__get_stream_buffer_pointers
_o__getch
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime32
_o__lock_file
_o__malloc_base
_o__purecall
_o__realloc_base
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__Strftime
_o__stricmp
_o__unlock_file
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__wcsdup
_o__Wcsftime
_o__wcsicmp
_o__wfsopen
_o__wtof
_o__wtoi
_o__wtoi64
_o__wunlink
_o_abort
_o_atof
_o_atoi
_o_calloc
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_floor
_o_fopen
_o_fputc
_o_fputwc
_o_fread
_o_free
_o_frexp
_o_fseek
_o_fsetpos
_o_fwrite
_o_getchar
_o_islower
_o_isspace
_o_isupper
_o_iswascii
_o_iswgraph
_o_ldexp
_o_localeconv
_o_log2
_o_malloc
_o_realloc
_o_setlocale
_o_setvbuf
_o_strtod
_o_strtof
_o_terminate
_o_tolower
_o_toupper
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscat_s
_o_wcscpy_s
_o_wcstoul
__uncaught_exception
__current_exception
__AdjustPointer
__current_exception_context
_except_handler4_common
wcsstr
_CxxThrowException
_o__exit
_o__errno
_o__crt_atexit
_o__controlfp_s
_o__configure_narrow_argv
_o__configthreadlocale
_o__CIpow
_o__cexit
_o__calloc_base
_o__callnewh
_o__beginthread
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___stdio_common_vfprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___p___argv
_o___p___argc
_o___acrt_iob_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__CxxFrameHandler3
strchr
__std_type_info_compare
memchr
memcmp
memcpy
memmove
ntdll
RtlNtStatusToDosError
NtQueryInformationProcess
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
xmllite
CreateXmlWriter
CreateXmlReader
dxgi
CreateDXGIFactory1
CreateDXGIFactory
d3d11
D3D11CreateDeviceAndSwapChain
D3D11CreateDevice
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
api-ms-win-core-job-l2-1-0
QueryInformationJobObject
AssignProcessToJobObject
CreateJobObjectW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CLSIDFromString
CoInitializeEx
ext-ms-win-rtcore-ntuser-sysparams-l1-1-0
EnumDisplayDevicesW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExA
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
CreateEventW
ReleaseSRWLockShared
ReleaseMutex
SetEvent
InitializeCriticalSectionEx
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSemaphore
TryAcquireSRWLockExclusive
CreateMutexExW
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
ExitProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
CreateProcessW
ResumeThread
ProcessIdToSessionId
GetExitCodeProcess
TerminateProcess
OpenThread
GetCurrentProcess
CreateThread
api-ms-win-core-localization-l1-2-0
FormatMessageA
LCMapStringEx
GetCPInfo
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysFreeString
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
SearchPathW
GetEnvironmentVariableW
GetStdHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
GetSystemDirectoryW
GlobalMemoryStatusEx
api-ms-win-core-console-l2-1-0
GetConsoleScreenBufferInfo
api-ms-win-core-file-l1-1-0
FindFirstFileW
SetFilePointerEx
WriteFile
ReadFile
CreateFileW
GetFileSizeEx
FindClose
GetFullPathNameW
FileTimeToLocalFileTime
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-psapi-l1-1-0
K32GetProcessImageFileNameW
K32EnumProcesses
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeConditionVariable
WakeConditionVariable
InitOnceExecuteOnce
Sleep
api-ms-win-core-string-l1-1-0
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringEx
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
api-ms-win-core-memory-l1-1-0
VirtualQuery
MapViewOfFile
ReadProcessMemory
VirtualProtect
WriteProcessMemory
VirtualFree
VirtualAlloc
CreateFileMappingW
UnmapViewOfFile
OpenFileMappingW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-base-l1-1-0
GetLengthSid
IsValidSid
CopySid
AdjustTokenPrivileges
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorSacl
AddMandatoryAce
GetTokenInformation
FreeSid
InitializeAcl
api-ms-win-security-appcontainer-l1-1-0
GetAppContainerNamedObjectPath
api-ms-win-core-namedpipe-l1-1-0
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
api-ms-win-core-io-l1-1-1
CancelSynchronousIo
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoInitialize
RoUninitialize
api-ms-win-core-kernel32-legacy-l1-1-0
LoadLibraryW
CreateSemaphoreW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
LocalAlloc
api-ms-win-crt-time-l1-1-0
_time32
dbghelp
MiniDumpWriteDump
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
Sections
.text Size: 841KB - Virtual size: 841KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ