dxva2[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dxva2.dll
Size

103KB
MD5

bfca438217eefdff07ccd6a7b61dfc00
SHA1

018da68756fa69d25d1d636df51e8b6aaed0fe20
SHA256

9aa1cf331a1fecb46a35c38ac5ee5ce51a205b25155001a8292131abddbe6790
SHA512

6368c67cc54c6bf644bd2a38831dc18c487a61fdffe3461acaf5d16fc9e44f860c9b620ffe0f29e433107c058d0fa17418c90165a13f921543dbaebd0bc82e98
SSDEEP

1536:WI/UABUYBgxqFzrn1jrfxcsqCnVqis+WgEmSZ7yjX7mgpZva5gBBgPb:XHyzYxj1jrJJJnVqis+4KjXvi5fT

Score

1^/10

Malware Config

Signatures

Files

dxva2.dll
.dll windows:10 windows x86 arch:x86

7eef00f2936fbfc8faa4ada771236062

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:a3:7c:d3:e2:83:44:26:11:d6:c3:b7:37:34:ef:72:e6:72:54:7d:7c:94:40:82:a1:96:f3:d0:09:b9:26:77
Signer

Actual PE Digest

af:a3:7c:d3:e2:83:44:26:11:d6:c3:b7:37:34:ef:72:e6:72:54:7d:7c:94:40:82:a1:96:f3:d0:09:b9:26:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dxva2.pdb

Imports

msvcrt

_amsg_exit
_XcptFilter
_except_handler4_common
memcpy
_initterm
memcmp
_ftol2_sse
_ftol2
free
_callnewh
malloc
memset

api-ms-win-core-synch-l1-1-0

SetEvent
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
CreateEventW
DeleteCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CapabilitiesRequestAndCapabilitiesReply
DXVA2CreateDirect3DDeviceManager9
DXVA2CreateVideoService
DXVAHD_CreateDevice
DegaussMonitor
DestroyPhysicalMonitor
DestroyPhysicalMonitors
GetCapabilitiesStringLength
GetMonitorBrightness
GetMonitorCapabilities
GetMonitorColorTemperature
GetMonitorContrast
GetMonitorDisplayAreaPosition
GetMonitorDisplayAreaSize
GetMonitorRedGreenOrBlueDrive
GetMonitorRedGreenOrBlueGain
GetMonitorTechnologyType
GetNumberOfPhysicalMonitorsFromHMONITOR
GetNumberOfPhysicalMonitorsFromIDirect3DDevice9
GetPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromIDirect3DDevice9
GetTimingReport
GetVCPFeatureAndVCPFeatureReply
OPMGetVideoOutputForTarget
OPMGetVideoOutputsFromHMONITOR
OPMGetVideoOutputsFromIDirect3DDevice9Object
RestoreMonitorFactoryColorDefaults
RestoreMonitorFactoryDefaults
SaveCurrentMonitorSettings
SaveCurrentSettings
SetMonitorBrightness
SetMonitorColorTemperature
SetMonitorContrast
SetMonitorDisplayAreaPosition
SetMonitorDisplayAreaSize
SetMonitorRedGreenOrBlueDrive
SetMonitorRedGreenOrBlueGain
SetVCPFeature

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eef00f2936fbfc8faa4ada771236062

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

af:a3:7c:d3:e2:83:44:26:11:d6:c3:b7:37:34:ef:72:e6:72:54:7d:7c:94:40:82:a1:96:f3:d0:09:b9:26:77Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 85KB - Virtual size: 84KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

af:a3:7c:d3:e2:83:44:26:11:d6:c3:b7:37:34:ef:72:e6:72:54:7d:7c:94:40:82:a1:96:f3:d0:09:b9:26:77
Signer

.text
Size: 85KB - Virtual size: 84KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB