dxcpl[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dxcpl.exe
Size

240KB
MD5

632c913e3c3e07b5a6c0d3f600ea0c70
SHA1

873f9be8aea145f389b15297448d46f97ae017bb
SHA256

a89cea7a62d62b3346f77428d1c9f35bf28aba1c1d23728019dfaf10b5d7c1fd
SHA512

cd51b516b485c236325fc4b6c3ebd0fe92237a071ea19ed8dc1219892c54abe6adda54883551531dc647f864bef6467ac5d203944d8113af6192f5a381406332
SSDEEP

1536:iW5zbd4hbTNQ9XftASiVHjpQXHgvLCv0B0Ui92bBH1Zbg+wgqXwJ3d6dhSD4nc2z:ktCMjPtO13M3Zww/Lh0042P0kzRk3

Score

1^/10

Malware Config

Signatures

Files

dxcpl.exe
.exe windows:6 windows x64 arch:x64

b513132dc7eef4e1fd9c04210fc4d4c5

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09-01-2012 22:25

Not After

09-04-2013 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:45

Not After

10-01-2013 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:32:7f:4a:8d:26:c1:cb:5e:42:f6:cd:e0:ad:73:7b:15:90:6d:12:2f:58:4e:40:cc:d7:a7:ab:cf:e6:cd:27
Signer

Actual PE Digest

fc:32:7f:4a:8d:26:c1:cb:5e:42:f6:cd:e0:ad:73:7b:15:90:6d:12:2f:58:4e:40:cc:d7:a7:ab:cf:e6:cd:27

Digest Algorithm

sha256

PE Digest Matches

true

45:e3:53:b6:81:68:a7:e7:ae:fe:e4:45:f0:8c:bc:e6:49:1a:dd:14
Signer

Actual PE Digest

45:e3:53:b6:81:68:a7:e7:ae:fe:e4:45:f0:8c:bc:e6:49:1a:dd:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

DXCpl.pdb

Imports

advapi32

RegCreateKeyExW
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegDeleteValueW
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
RegSetKeySecurity
RegOpenKeyExW
RegCloseKey
RegSetValueExW

kernel32

GetVersionExW
LoadLibraryW
HeapDestroy
LocalFree
DebugBreak
GetCurrentDirectoryW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
Sleep
LocalAlloc
HeapCreate
FreeLibrary
GetFullPathNameW
GetTickCount

gdi32

CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W

user32

CheckDlgButton
SetCursor
SendDlgItemMessageW
ShowWindow
GetDlgItem
ReleaseDC
GetDC
DialogBoxParamW
IsDlgButtonChecked
CheckRadioButton
MessageBoxW
GetDlgItemTextW
SetDlgItemTextW
SendMessageW
EndDialog
LoadStringW
SystemParametersInfoW
LoadCursorW
GetParent
EnableWindow

msvcrt

_fmode
_commode
_lock
_ismbblead
_acmdln
_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
__dllonexit
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
__CxxFrameHandler3
_CxxThrowException
towupper
memcpy_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
vswprintf_s
wcsnlen
_wcsnicmp
_wtoi
memmove_s
swprintf_s
_unlock
??0exception@@QEAA@XZ
memset

comctl32

ord17
PropertySheetW

comdlg32

GetOpenFileNameW

shlwapi

PathUnquoteSpacesW
SHDeleteKeyW
PathIsUNCW
PathAddBackslashW

shell32

ord680
ShellExecuteW

Sections

.text
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b513132dc7eef4e1fd9c04210fc4d4c5

Code Sign

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:02:92:4a:00:00:00:00:00:20Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:05:49:55:00:00:00:00:00:0bCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

fc:32:7f:4a:8d:26:c1:cb:5e:42:f6:cd:e0:ad:73:7b:15:90:6d:12:2f:58:4e:40:cc:d7:a7:ab:cf:e6:cd:27Signer

45:e3:53:b6:81:68:a7:e7:ae:fe:e4:45:f0:8c:bc:e6:49:1a:dd:14Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

comdlg32

shlwapi

shell32

Sections

.text Size: 183KB - Virtual size: 183KB

.data Size: 512B - Virtual size: 279KB

.pdata Size: 1KB - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 34KB - Virtual size: 33KB

.reloc Size: 1024B - Virtual size: 624B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:02:92:4a:00:00:00:00:00:20
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:05:49:55:00:00:00:00:00:0b
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

fc:32:7f:4a:8d:26:c1:cb:5e:42:f6:cd:e0:ad:73:7b:15:90:6d:12:2f:58:4e:40:cc:d7:a7:ab:cf:e6:cd:27
Signer

45:e3:53:b6:81:68:a7:e7:ae:fe:e4:45:f0:8c:bc:e6:49:1a:dd:14
Signer

.text
Size: 183KB - Virtual size: 183KB

.data
Size: 512B - Virtual size: 279KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 1024B - Virtual size: 624B