Dxpserver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Dxpserver.exe
Size

203KB
MD5

e570cc96463a5e480e2807b032e7f52e
SHA1

cc112c1e30e88c2ed0f0feee31007dbffc4c9242
SHA256

630622d33354c1480b3d43338e6124287f01591927d1ea602dac7e3a6aa7b0c2
SHA512

530506d639a311fda888bbdacdcd753a2e532392251d9fed3e4ec5d622fc8db25868f62c008c056ff337792a300bbe3368d69a09b6add7662e6174206eece9da
SSDEEP

3072:RZT25+ANZei1pAW/mu9Hcz0dKdr8pO8EkgUYrq0hUk7WciHxOxwF:RK+sZVg/88z0dqrsbEecq0HTw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dxpserver.exe

Files

Dxpserver.exe
.exe windows x86

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
EventRegister
EventUnregister
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegNotifyChangeKeyValue
EventWrite
RegGetValueW
RegQueryValueExW

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
SetLastError
GetTickCount
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
EnterCriticalSection
GetModuleFileNameW
CreateMutexW
Sleep
CreateEventW
CreateThread
GetCurrentThreadId
SetEvent
GetCommandLineW
GetSystemTimeAsFileTime
CloseThreadpoolTimer
SetThreadpoolTimer
ResetEvent
CreateThreadpoolTimer
FlushInstructionCache
GetCurrentProcess
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
FindFirstFileW
CompareStringOrdinal
CreateFileW
CloseHandle
GetLastError
LoadLibraryExW
SetFileAttributesW
FindClose
FindNextFileW
MoveFileW
GetVersionExA
CopyFileExW
SetFilePointer
GetFileMUIPath
GetFileAttributesW
CompareFileTime
GetSystemInfo
GetSystemDefaultLCID
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
LCMapStringW
SystemTimeToFileTime
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange

gdi32

DeleteObject
CreateCompatibleDC
SelectObject
SetLayout
DeleteDC
CreateCompatibleBitmap
CreateDIBSection
CreateRectRgn

user32

GetMenuState
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
UnregisterClassA
LoadStringW
InsertMenuW
CharNextW
PostThreadMessageW
CharUpperW
GetMessageW
MsgWaitForMultipleObjects
EnumWindows
DispatchMessageW
TranslateMessage
PeekMessageW
DispatchMessageA
GetMessageA
IsWindowUnicode
CreateIconIndirect
DrawIconEx
GetIconInfo
SetWindowLongW
GetWindowLongW
PostMessageW
IsIconic
ShowWindow
SendMessageW
SetWindowRgn
GetClassInfoExW
LoadCursorW
LoadImageW
GetSystemMetrics
DestroyIcon
PostQuitMessage
CheckMenuItem
GetSystemMenu
SetWindowTextW
ModifyMenuW
DeleteMenu
CallWindowProcW
DefWindowProcW

msvcrt

??3@YAXPAX@Z
??_V@YAXPAX@Z
_vsnwprintf
??_U@YAPAXI@Z
memset
free
malloc
memcpy_s
memmove_s
wcsncpy_s
_purecall
??2@YAPAXI@Z
wcscpy_s
wcscat_s
swprintf_s
_ftol2
bsearch
qsort
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
realloc
_errno
_unlock
__dllonexit
wcstoul
swscanf_s
iswspace
_lock
_onexit
?terminate@@YAXXZ
_controlfp
exit

ole32

PropVariantCopy
CoFreeUnusedLibrariesEx
PropVariantClear
CoDisconnectObject
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoResumeClassObjects

oleaut32

VariantInit
VariantClear
SysFreeString
VarUI4FromStr
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantChangeType

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
ord615
ord487
ord16
SHStrDupW
UrlEscapeW
SHCreateStreamOnFileW
PathParseIconLocationW
SHCreateStreamOnFileEx
UrlUnescapeW

propsys

PropVariantCompareEx
PSGetPropertyKeyFromName
StgDeserializePropVariant
PropVariantToStringAlloc
PropVariantChangeType
PSCreateMemoryPropertyStore
PSGetPropertyDescriptionListFromString
PSGetPropertyDescriptionByName
PropVariantToGUID

shell32

ShellExecuteExW
ord155
SHCreateShellItemArrayFromIDLists
ord6
SHGetPropertyStoreForWindow
Shell_NotifyIconW
SHParseDisplayName
SHQueryUserNotificationState
ord165

dwmapi

DwmSetWindowAttribute
DwmSetIconicThumbnail

gdiplus

GdipSetSmoothingMode
GdipFree
GdipAlloc
GdiplusStartup
GdipCreateFromHDC
GdipCreateBitmapFromFileICM
GdipCloneImage
GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipDrawImageRectI

ntdll

WinSqmSetString
WinSqmAddToStreamEx
WinSqmEndSession
WinSqmIsOptedIn
WinSqmStartSession
WinSqmIncrementDWORD
WinSqmSetDWORD
RtlGetNativeSystemInformation

xmllite

CreateXmlReader

rpcrt4

UuidFromStringW

msi

ord113

crypt32

CertVerifyCertificateChainPolicy

wintrust

CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shlwapi

propsys

shell32

dwmapi

gdiplus

ntdll

xmllite

rpcrt4

msi

crypt32

wintrust

Sections

.text Size: 151KB - Virtual size: 150KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 151KB - Virtual size: 150KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 10KB - Virtual size: 9KB