DTSGFXAPO[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DTSGFXAPO.dll
Size

213KB
MD5

c77a4ca13cf78e242c5844d045edfda0
SHA1

085d7d38c4687723c5d52afaa76463fac3d08782
SHA256

0884e40ae58b26381c043e4fa6e2d75373153cc8cb7760a95f773a8701f07b0a
SHA512

074768d78d9ab3aa7e857fccddb6c5a0a20dad2333d5c18774d734dbaf44828d98e67c245fd20052dffc665936b80bb82b255f2f8825afe8ce82843c45652b68
SSDEEP

3072:PBrPxNIIwThnhNlFrQDEPLB3v+pjulO2SsYVEN1AfmuwPk+rxFRFhr:PBrPvXpjulO2SR1muqdfhr

Score

1^/10

Malware Config

Signatures

Files

DTSGFXAPO.dll
.dll regsvr32 windows:6 windows x86 arch:x86

015d28217bdf4d80adc63b6d7f5c5440

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5c:56:7a:3f:66:fa:6c:4c:82:a6:9e:d4:17:92:b9:0a:91:c9:fa:7d
Signer

Actual PE Digest

5c:56:7a:3f:66:fa:6c:4c:82:a6:9e:d4:17:92:b9:0a:91:c9:fa:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\projects\apoph1~1\v21\ps_ref\src\pcaudi~1\src\gfx\objfre_wlh_x86\i386\DTSGFXAPO.pdb

Imports

msvcrt

memmove_s
fopen
fclose
fflush
ftell
fwrite
fseek
feof
fread
wcscat_s
wcscpy_s
malloc
free
calloc
_CxxThrowException
_wcsicmp
_vsnwprintf
_resetstkoflw
??3@YAXPAX@Z
wcslen
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
??2@YAPAXI@Z
memcpy
??_U@YAPAXI@Z
memset
_purecall
__CxxFrameHandler3
??_V@YAXPAX@Z
_ftol2
wcsncpy_s
realloc
_errno
_unlock
__dllonexit
_lock
_onexit
memcpy_s

kernel32

HeapAlloc
GetProcessHeap
HeapFree
SetEvent
OutputDebugStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
GetVersion
WideCharToMultiByte
GetVersionExA
GetThreadLocale
SetThreadLocale
LeaveCriticalSection
EnterCriticalSection
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
InterlockedExchange
CreateThread
WaitForSingleObject
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW

ole32

StringFromGUID2
CoGetClassObject
PropVariantClear
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString
StringFromCLSID

oleaut32

VarUI4FromStr
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysFreeString

advapi32

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteKeyW

user32

GetMessageW
PostThreadMessageW
UnregisterClassA
CharLowerA
CharLowerW
CharUpperW
CharNextW
CharUpperA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 265B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

015d28217bdf4d80adc63b6d7f5c5440

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53Certificate

Extended Key Usages

Key Usages

5c:56:7a:3f:66:fa:6c:4c:82:a6:9e:d4:17:92:b9:0a:91:c9:fa:7dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

oleaut32

advapi32

user32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 171KB

RT_CODE Size: 5KB - Virtual size: 5KB

RT_BSS Size: - Virtual size: 265B

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

RT_DATA Size: 2KB - Virtual size: 1KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

5c:56:7a:3f:66:fa:6c:4c:82:a6:9e:d4:17:92:b9:0a:91:c9:fa:7d
Signer

.text
Size: 172KB - Virtual size: 171KB

RT_CODE
Size: 5KB - Virtual size: 5KB

RT_BSS
Size: - Virtual size: 265B

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

RT_DATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 4KB - Virtual size: 3KB