dxilconv[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dxilconv.dll
Size

845KB
MD5

9723c787e8349896692e885bcccf0ef3
SHA1

b42f901354d05672d46ee19825fc1de475697fdb
SHA256

04ef07cd47737d64789a988da330e406d20bc2e87bc0db05f8baa805023f9bdc
SHA512

0a6ad19fdd6207996f55e666a84a1997b1f36b8b4cba917d432e2b0b5c9974552e9d8c8b44e38185a4d771cc8b07405a81417c5cf1b327a3b76d4598e97d433b
SSDEEP

24576:Q2eyoZF/K1UXm2A68mIpEz96FbyzYwYKp9hQW5BunmvqLD:peyopXm2A68mIpm6FmlY0n7GmvqH

Score

1^/10

Malware Config

Signatures

Files

dxilconv.dll
.dll windows:10 windows x86 arch:x86

89e90ba8671ba0043174d9dcd68e5da4

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:64:18:1c:3b:74:f0:29:36:e9:8a:05:b4:e3:d8:bf:df:73:2e:5b:d9:e4:6d:a2:e8:3f:50:0e:cd:2b:54:90
Signer

Actual PE Digest

8a:64:18:1c:3b:74:f0:29:36:e9:8a:05:b4:e3:d8:bf:df:73:2e:5b:d9:e4:6d:a2:e8:3f:50:0e:cd:2b:54:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dxilconv.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__chsize
_o__CIpow
_o__CIsqrt
_o__close
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fpclass
_o__get_osfhandle
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__lseek
_o__open_osfhandle
_o__purecall
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__setmode
memmove
_o__write
_o__wsopen_dispatch
_o_abort
_o_acos
_o_asin
_o_atan
_o_atan2
_o_atoi
_o_calloc
_o_ceil
_o_cos
_o_cosh
_o_exp
_o_exp2
_o_fabs
_o_floor
_o_fmod
_o_free
_o_isalnum
_o_isalpha
_o_isdigit
_o_isprint
_o_log
_o_log10
_o_log2
_o_malloc
_o_modf
_o_pow
_o_qsort
_o_sin
_o_sinh
_o_sqrt
_o_tan
_o_tanh
_o_terminate
_except_handler4_common
_CxxThrowException
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
memchr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
strncmp

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetProcessTimes
TlsFree
TlsSetValue
TlsAlloc
GetCurrentProcessId
TlsGetValue

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
GetStdHandle

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-console-l1-1-0

GetConsoleMode

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindClose
ReadFile
CreateDirectoryW
GetFileInformationByHandle
GetFileType
FindFirstFileW
DeleteFileW
SetFileTime

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l2-1-0

CreateHardLinkW
MoveFileExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

Exports

Exports

DxcCreateInstance
DxcCreateInstance2

Sections

.text
Size: 793KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89e90ba8671ba0043174d9dcd68e5da4

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

8a:64:18:1c:3b:74:f0:29:36:e9:8a:05:b4:e3:d8:bf:df:73:2e:5b:d9:e4:6d:a2:e8:3f:50:0e:cd:2b:54:90Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

Exports

Exports

Sections

.text Size: 793KB - Virtual size: 792KB

.data Size: 4KB - Virtual size: 27KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 24KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

8a:64:18:1c:3b:74:f0:29:36:e9:8a:05:b4:e3:d8:bf:df:73:2e:5b:d9:e4:6d:a2:e8:3f:50:0e:cd:2b:54:90
Signer

.text
Size: 793KB - Virtual size: 792KB

.data
Size: 4KB - Virtual size: 27KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 24KB