DTSU2PGFX32[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DTSU2PGFX32.dll
Size

393KB
MD5

ad073765f57874aa803d72b0785e312f
SHA1

d7f56aace781fb1ca4eda6a1331601e3d3da983f
SHA256

25cf53c2f46e2970caf8c06234c23bc0b29e22c4e74503d9ae309fb1d9e8dada
SHA512

5179d7aebb06eb46285244e992230ae161418eab4cf0a23542aecac7fa6379628acb15b8734ab86ec7756d2916f944a6cc4a30a9c83a88066ff0bd06d918917e
SSDEEP

3072:gGxoaFRDeQLIIIxTA3vwwwk11IIqHMkTb3vbmOCYZRG0wEt9KfT4disUFq6i/z7g:zzFNVuMkvPreXFt4M2OyovOfZiJzt

Score

1^/10

Malware Config

Signatures

Files

DTSU2PGFX32.dll
.dll regsvr32 windows:6 windows x86 arch:x86

4db995fbb140831f27420b05a73b4fbb

Code Sign

07:27:58:3d
Certificate

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Not Before

13/01/2010, 19:20

Not After

30/09/2015, 18:19

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:9f:ed:ed:cb:79:5b:8d:ed:32:0c:89:19:f0:36:89
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21/05/2013, 00:00

Not After

04/06/2014, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:92:38:26:c2:c0:13:5f:14:7a:7f:0a:71:a7:ea:fa
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/01/2012, 00:00

Not After

28/01/2015, 12:00

Subject

CN=DTS\, Inc.,O=DTS\, Inc.,L=Calabasas,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:1c:57:ee:5d:70:eb:9b:a0:b1:52:0c:72:9c:1b:09
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:61:c2:a1:c6:4d:65:55:44:ae:82:01:08:5d:19:0f:86:99:75:0f
Signer

Actual PE Digest

2c:61:c2:a1:c6:4d:65:55:44:ae:82:01:08:5d:19:0f:86:99:75:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\cygwin\tmp\inst~1\src\pcaudi~1\releas~1\ultrap~1\pcaudi~1\src\psphase2\gfx\objfre_wlh_x86\i386\DTSAPO_PSPhase2GFX.pdb

Imports

msvcrt

fopen
fclose
fflush
ftell
fwrite
fseek
feof
ferror
fread
__libm_sse2_cos
__libm_sse2_sin
__libm_sse2_exp
wcscat_s
wcscpy_s
_XcptFilter
_initterm
memmove_s
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
realloc
_errno
memcpy
_aligned_malloc
memset
_aligned_free
__libm_sse2_pow
_purecall
__CxxFrameHandler3
_ftol2
calloc
_resetstkoflw
wcslen
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
malloc
_amsg_exit
_callnewh
_vsnwprintf
_wcsicmp
memmove
strstr
sscanf_s
isprint
strtok
strncpy
atof
_ftol2_sse
_CIpow
wcsncpy_s
_CxxThrowException
memcpy_s
free
__libm_sse2_log10

kernel32

HeapAlloc
GetProcessHeap
lstrcpyW
lstrcpynW
lstrlenA
HeapFree
OutputDebugStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrcmpiA
CompareStringW
CompareStringA
WideCharToMultiByte
InterlockedExchange
GetVersionExA
GetThreadLocale
SetThreadLocale
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetVersion
LeaveCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObject
CloseHandle
CreateThread
CreateEventW
FreeLibrary

ole32

PropVariantClear
CLSIDFromString
CoGetClassObject
CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID

oleaut32

SysFreeString
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
VarUI4FromStr
VariantClear
VariantCopy
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW

user32

CharUpperA
CharLowerW
CharLowerA
UnregisterClassA
PostThreadMessageW
PeekMessageW
GetMessageW
CharNextW
CharUpperW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 265B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4db995fbb140831f27420b05a73b4fbb

Code Sign

07:27:58:3dCertificate

Key Usages

03:9f:ed:ed:cb:79:5b:8d:ed:32:0c:89:19:f0:36:89Certificate

Extended Key Usages

Key Usages

0b:92:38:26:c2:c0:13:5f:14:7a:7f:0a:71:a7:ea:faCertificate

Extended Key Usages

Key Usages

08:1c:57:ee:5d:70:eb:9b:a0:b1:52:0c:72:9c:1b:09Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

2c:61:c2:a1:c6:4d:65:55:44:ae:82:01:08:5d:19:0f:86:99:75:0fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

oleaut32

advapi32

user32

Exports

Exports

Sections

.text Size: 313KB - Virtual size: 312KB

RT_CODE Size: 6KB - Virtual size: 6KB

RT_BSS Size: - Virtual size: 265B

.data Size: 32KB - Virtual size: 34KB

.idata Size: 5KB - Virtual size: 4KB

RT_DATA Size: 2KB - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 9KB - Virtual size: 9KB

07:27:58:3d
Certificate

03:9f:ed:ed:cb:79:5b:8d:ed:32:0c:89:19:f0:36:89
Certificate

0b:92:38:26:c2:c0:13:5f:14:7a:7f:0a:71:a7:ea:fa
Certificate

08:1c:57:ee:5d:70:eb:9b:a0:b1:52:0c:72:9c:1b:09
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

2c:61:c2:a1:c6:4d:65:55:44:ae:82:01:08:5d:19:0f:86:99:75:0f
Signer

.text
Size: 313KB - Virtual size: 312KB

RT_CODE
Size: 6KB - Virtual size: 6KB

RT_BSS
Size: - Virtual size: 265B

.data
Size: 32KB - Virtual size: 34KB

.idata
Size: 5KB - Virtual size: 4KB

RT_DATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 9KB - Virtual size: 9KB