WinPixEventRuntime[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WinPixEventRuntime.dll
Size

32KB
MD5

e697f3f1b02990cc4cfe6f666b40dc5d
SHA1

5c47ea92f2129ffb811cb93577669e46129fbfed
SHA256

23ef5b23f1cf6f1b7132542c4063b5e9da532572634afa41f27139bbf02468fc
SHA512

98953628f01a2ea2a3d68bc08d922f6d434fc8d4c140821af7fe96c953caf03bdac6da12afdb63e1303fd4829d374aadae3098b082010dd00bf1bec9f625bc33
SSDEEP

768:64tpkqpExWHjq4vXcRd+HcKL4a/MJBK4pR:64tV/jq6ML+Hp4akJBK4pR

Score

1^/10

Malware Config

Signatures

Files

WinPixEventRuntime.dll
.dll windows x64

ee76703011a95ee1a7bcc254c6c8e8fd

Code Sign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:88:3f:4d:f3:b6:7f:da:7b:85:3c:6b:35:a8:b5:c9:85:26:43:4a:76:d9:7a:3b:1f:64:59:9a:50:76:ea:32
Signer

Actual PE Digest

79:88:3f:4d:f3:b6:7f:da:7b:85:3c:6b:35:a8:b5:c9:85:26:43:4a:76:d9:7a:3b:1f:64:59:9a:50:76:ea:32

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentThreadId
QueryPerformanceCounter
LeaveCriticalSection
GetCurrentProcessId
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess

advapi32

EventRegister
EventWrite
EventUnregister

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list
__std_exception_destroy
__CxxFrameHandler3
memset
__C_specific_handler
__std_exception_copy
_CxxThrowException
__std_terminate
memmove

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_cexit
_register_onexit_function
_execute_onexit_table
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

Exports

Exports

PIXBeginCapture
PIXEndCapture
PIXEventsReplaceBlock
PIXGetCaptureState
PIXGetThreadInfo
PIXNotifyWakeFromFenceSignal
PIXReportCounter

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee76703011a95ee1a7bcc254c6c8e8fd

Code Sign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

79:88:3f:4d:f3:b6:7f:da:7b:85:3c:6b:35:a8:b5:c9:85:26:43:4a:76:d9:7a:3b:1f:64:59:9a:50:76:ea:32Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 100B

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

79:88:3f:4d:f3:b6:7f:da:7b:85:3c:6b:35:a8:b5:c9:85:26:43:4a:76:d9:7a:3b:1f:64:59:9a:50:76:ea:32
Signer

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 100B