Dxpserver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Dxpserver.exe
Size

302KB
MD5

72f19cdd82dec6f07663470839d395c3
SHA1

7874255504d88399ff50c3ff4bc5cd8fb00526bd
SHA256

deb7e1e512722260c9f4a5c8917dde663f6783fab54659ceecc8279e05ee92e9
SHA512

27237d6d75fc11acb4b2df7196515859d1d2091a6aaeedca47944b62edb4d173b5abe7464a3d37ecd6c5648b5b7c481e86446d5af28e173879c114adadfea523
SSDEEP

6144:n8DRPHuzfhzPnKyRHrpNA+CBbZJqzOfZ:n8DRuRre+ibWqf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dxpserver.exe

Files

Dxpserver.exe
.exe windows x64

022045a4cf899dc9c6bd2745191c5d08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
EventUnregister
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegNotifyChangeKeyValue
EventWriteTransfer
EventSetInformation
EventActivityIdControl
RegGetValueW
RegQueryValueExW

kernel32

GetModuleHandleW
lstrcmpiW
RaiseException
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
WaitForSingleObject
ReleaseSemaphore
SetLastError
CreateSemaphoreW
CreateMutexW
CreateEventW
SetEvent
GetCommandLineW
GetCurrentThreadId
CreateThread
Sleep
FormatMessageW
LoadLibraryExW
GetProcessHeap
HeapAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
ResetEvent
ReleaseMutex
SetThreadpoolTimer
CloseThreadpoolTimer
CloseHandle
AcquireSRWLockExclusive
OpenSemaphoreW
CreateThreadpoolTimer
GetSystemTimeAsFileTime
InitOnceBeginInitialize
InitOnceComplete
GetCurrentProcessId
CreateMutexExW
ReleaseSRWLockExclusive
CreateSemaphoreExW
ExpandEnvironmentStringsW
LocalFree
InitializeCriticalSectionAndSpinCount
FindFirstFileW
GetProcAddress
FreeLibrary
FindClose
FindNextFileW
MoveFileW
CopyFileExW
SetFileAttributesW
HeapFree
GetLastError
SetFilePointer
GetFileAttributesW
GetFileMUIPath
CompareFileTime
GetSystemInfo
LCMapStringW
LCIDToLocaleName
GetSystemDefaultLCID
GetUserDefaultLCID
GetUserGeoID
SystemTimeToFileTime
OutputDebugStringA
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
CreateFileW
CompareStringOrdinal
WaitForSingleObjectEx

gdi32

CreateCompatibleBitmap
DeleteDC
SetLayout
SelectObject
CreateCompatibleDC
DeleteObject
CreateDIBSection
CreateRectRgn

user32

CreateWindowExW
LoadCursorW
PostThreadMessageW
CharUpperW
DispatchMessageA
GetMessageA
IsWindowUnicode
GetIconInfo
DrawIconEx
CreateIconIndirect
DestroyIcon
RegisterWindowMessageW
DefWindowProcW
UnregisterClassA
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
GetSystemMenu
GetMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
CharNextW
GetClassInfoExW
LoadStringW
InsertMenuW
ModifyMenuW
DeleteMenu
CheckMenuItem
ShowWindow
SetWindowRgn
PostQuitMessage
IsIconic
GetSystemMetrics
SendMessageW
LoadImageW
GetMenuState
PostMessageW
GetWindowLongW
EnumWindows
RegisterClassExW
SetWindowTextW

msvcrt

wcscpy_s
memmove_s
wcscat_s
swprintf_s
bsearch
memcpy_s
_callnewh
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
_vsnwprintf
__C_specific_handler
wcsncpy_s
_purecall
__setusermatherr
_initterm
_wcmdln
_fmode
_commode
_errno
malloc
free
memcmp
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
realloc
wcstoul
swscanf_s
iswspace
qsort
memset

ole32

CoMarshalInterThreadInterfaceInStream
CoDisconnectObject
CoFreeUnusedLibrariesEx
CoUnmarshalInterface
CoSuspendClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateGuid
PropVariantCopy
PropVariantClear

oleaut32

RegisterTypeLi
LoadTypeLi
VariantClear
UnRegisterTypeLi
VarUI4FromStr
SysFreeString
SysAllocString
SysStringLen
VariantChangeType
VariantInit

shlwapi

PathParseIconLocationW
SHCreateStreamOnFileW
UrlEscapeW
ord16
SHStrDupW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
ord615
ord487
SHCreateStreamOnFileEx

propsys

StgDeserializePropVariant
PropVariantToGUID
PSGetPropertyKeyFromName
PropVariantToStringAlloc
PropVariantChangeType
PSCreateMemoryPropertyStore
PropVariantCompareEx
PSGetPropertyDescriptionByName
PSGetPropertyDescriptionListFromString

shell32

ord155
SHParseDisplayName
ord6
Shell_NotifyIconW
SHQueryUserNotificationState
SHCreateShellItemArrayFromIDLists
ShellExecuteExW
ord165
SHGetPropertyStoreForWindow

dwmapi

DwmSetWindowAttribute
DwmSetIconicThumbnail

gdiplus

GdipDrawImageRectI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipFree
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromFile
GdiplusStartup

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
WinSqmSetString
WinSqmAddToStreamEx
RtlVirtualUnwind
WinSqmSetDWORD
WinSqmIncrementDWORD
WinSqmStartSession
WinSqmIsOptedIn
WinSqmEndSession
RtlGetNativeSystemInformation

xmllite

CreateXmlReader

rpcrt4

UuidFromStringW

msi

ord113

crypt32

CertVerifyCertificateChainPolicy

wintrust

CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrustEx
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
WTHelperProvDataFromStateData
CryptCATAdminAcquireContext
WTHelperGetProvSignerFromChain
CryptCATAdminEnumCatalogFromHash

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

022045a4cf899dc9c6bd2745191c5d08

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shlwapi

propsys

shell32

dwmapi

gdiplus

ntdll

xmllite

rpcrt4

msi

crypt32

wintrust

Sections

.text Size: 195KB - Virtual size: 194KB

.rdata Size: 53KB - Virtual size: 52KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 195KB - Virtual size: 194KB

.rdata
Size: 53KB - Virtual size: 52KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 3KB - Virtual size: 2KB