dxcpl[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dxcpl.exe
Size 240KB
Sample240305-xt5xmaff55
SHA256 a89cea7a62d62b3346f77428d1c9f35bf28aba1c1d23728019dfaf10b5d7c1fd
MD5 632c913e3c3e07b5a6c0d3f600ea0c70
SHA1 873f9be8aea145f389b15297448d46f97ae017bb
SHA512 cd51b516b485c236325fc4b6c3ebd0fe92237a071ea19ed8dc1219892c54abe6adda54883551531dc647f864bef6467ac5d203944d8113af6192f5a381406332
SSDEEP 1536:iW5zbd4hbTNQ9XftASiVHjpQXHgvLCv0B0Ui92bBH1Zbg+wgqXwJ3d6dhSD4nc2z:ktCMjPtO13M3Zww/Lh0042P0kzRk3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

dxcpl.exe

.exe 240KB

dxcpl.exe

IMPHASH b513132dc7eef4e1fd9c04210fc4d4c5
SHA256 a89cea7a62d62b3346f77428d1c9f35bf28aba1c1d23728019dfaf10b5d7c1fd
MD5 632c913e3c3e07b5a6c0d3f600ea0c70
SHA1 873f9be8aea145f389b15297448d46f97ae017bb
SHA512 cd51b516b485c236325fc4b6c3ebd0fe92237a071ea19ed8dc1219892c54abe6adda54883551531dc647f864bef6467ac5d203944d8113af6192f5a381406332
SSDEEP 1536:iW5zbd4hbTNQ9XftASiVHjpQXHgvLCv0B0Ui92bBH1Zbg+wgqXwJ3d6dhSD4nc2z:ktCMjPtO13M3Zww/Lh0042P0kzRk3
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

fc:32:7f:4a:8d:26:c1:cb:5e:42:f6:cd:e0:ad:73:7b:15:90:6d:12:2f:58:4e:40:cc:d7:a7:ab:cf:e6:cd:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 29, 2024

PE Signature issue

Digest

45:e3:53:b6:81:68:a7:e7:ae:fe:e4:45:f0:8c:bc:e6:49:1a:dd:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:02:92:4a:00:00:00:00:00:20

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2012 - Apr 9, 2013

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:49:55:00:00:00:00:00:0b

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

Major OS version

Entry point

184592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

DXCpl.pdb

advapi32

RegCreateKeyExW RegQueryValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegDeleteValueW AllocateAndInitializeSid SetEntriesInAclW FreeSid RegSetKeySecurity RegOpenKeyExW RegCloseKey RegSetValueExW

kernel32

GetVersionExW LoadLibraryW HeapDestroy LocalFree DebugBreak GetCurrentDirectoryW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStartupInfoW Sleep LocalAlloc HeapCreate FreeLibrary GetFullPathNameW GetTickCount

gdi32

CreateFontIndirectW DeleteObject GetTextExtentPoint32W

user32

CheckDlgButton SetCursor SendDlgItemMessageW ShowWindow GetDlgItem ReleaseDC GetDC DialogBoxParamW IsDlgButtonChecked CheckRadioButton MessageBoxW GetDlgItemTextW SetDlgItemTextW SendMessageW EndDialog LoadStringW SystemParametersInfoW LoadCursorW GetParent EnableWindow

msvcrt

_fmode _commode _lock _ismbblead _acmdln _onexit ??1type_info@@UEAA@XZ ?terminate@@YAXXZ __C_specific_handler _initterm __dllonexit __setusermatherr _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _callnewh ??0exception@@QEAA@AEBQEBDH@Z malloc free __CxxFrameHandler3 _CxxThrowException towupper memcpy_s ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@AEBQEBD@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ vswprintf_s wcsnlen _wcsnicmp _wtoi memmove_s swprintf_s _unlock ??0exception@@QEAA@XZ memset

comctl32

ord17 PropertySheetW

comdlg32

GetOpenFileNameW

shlwapi

PathUnquoteSpacesW SHDeleteKeyW PathIsUNCW PathAddBackslashW

shell32

ord680 ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

dxcpl.exe

PE Signature issue

PE Signature issue

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

comdlg32

shlwapi

shell32

generic