DTSLFXAPO[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DTSLFXAPO.dll
Size

213KB
MD5

5328523ac3fe93f61054823d90da73a5
SHA1

d417051fd210a6acd09f3a0c050063b889084f9b
SHA256

db70aa521f7f47b31275435919b9fe6aadc49b8d157f33ff01c124643421b91f
SHA512

40a60e10a7a1508f9dacbf0639b6cb1299e66189a110783efd8be62123e41e086f811f6bb6e4c844fb953ad89bab931ee7220a1981a048df53ce5e0c39127575
SSDEEP

3072:YawobIIcTs5QaGGcLmQj2Oy3v9urswZYEMk9LbX3uMbwPN+jZkMeVp:OzyQilurswBlX35bqs2XVp

Score

1^/10

Malware Config

Signatures

Files

DTSLFXAPO.dll
.dll regsvr32 windows:6 windows x86 arch:x86

c66771c99bb6360884364d1434f31d01

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

79:9a:4d:fd:b2:ef:33:dd:e7:52:b4:38:85:32:12:f6:42:48:72:5c
Signer

Actual PE Digest

79:9a:4d:fd:b2:ef:33:dd:e7:52:b4:38:85:32:12:f6:42:48:72:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\projects\apoph1~1\v21\ps_ref\src\pcaudi~1\src\lfx\objfre_wlh_x86\i386\DTSLFXAPO.pdb

Imports

msvcrt

_resetstkoflw
calloc
memmove_s
fopen
fclose
fflush
ftell
fwrite
fseek
feof
fread
wcscat_s
malloc
free
wcslen
_CxxThrowException
_wcsicmp
_vsnwprintf
memcpy
??3@YAXPAX@Z
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
realloc
wcscpy_s
??2@YAPAXI@Z
??_U@YAPAXI@Z
memset
_purecall
__CxxFrameHandler3
??_V@YAXPAX@Z
_ftol2
wcsncpy_s
_errno
_unlock
__dllonexit
_lock
_onexit
memcpy_s

kernel32

HeapAlloc
GetProcessHeap
HeapFree
SetEvent
OutputDebugStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
GetVersion
WideCharToMultiByte
GetVersionExA
GetThreadLocale
SetThreadLocale
LeaveCriticalSection
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
InterlockedExchange
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
EnterCriticalSection

ole32

StringFromGUID2
CLSIDFromString
PropVariantClear
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID

oleaut32

RegisterTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
SysFreeString

advapi32

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteKeyW

user32

UnregisterClassA
CharLowerA
CharLowerW
CharUpperA
CharNextW
CharUpperW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 265B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c66771c99bb6360884364d1434f31d01

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53Certificate

Extended Key Usages

Key Usages

79:9a:4d:fd:b2:ef:33:dd:e7:52:b4:38:85:32:12:f6:42:48:72:5cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

oleaut32

advapi32

user32

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 175KB

RT_CODE Size: 6KB - Virtual size: 5KB

RT_BSS Size: - Virtual size: 265B

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

RT_DATA Size: 2KB - Virtual size: 1KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

79:9a:4d:fd:b2:ef:33:dd:e7:52:b4:38:85:32:12:f6:42:48:72:5c
Signer

.text
Size: 176KB - Virtual size: 175KB

RT_CODE
Size: 6KB - Virtual size: 5KB

RT_BSS
Size: - Virtual size: 265B

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

RT_DATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 3KB