dpx[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dpx.dll
Size

542KB
MD5

94b32f65d75eb4e0e012dc74a8ac0947
SHA1

a6d40e63cacae4450129f06e28e4e86e49e0d3ca
SHA256

f581c75558dcd79939aaee2eab73ed026fc1a2c9d9ba83477705854440ac0c15
SHA512

f149643952c89ed9ad865130e5551ead3bccc617cf68a24ae0081720de5650d78c2407ea4db0a1e803ac93a535f46abfa3d5027ee241d8e17a2e4b2b60d60c57
SSDEEP

12288:M2J4DysVfOkKnqkSX/j25q07PGlwIR18FI/UcRyh0T1y/XBy4hkXQFxI:M2JfsV2kKqkSXL/ahe1EkAc

Score

1^/10

Malware Config

Signatures

Files

dpx.dll
.dll windows:10 windows x86 arch:x86

613f21eb23fcfc692166bef7b0011936

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:95:04:b7:83:30:aa:59:26:52:7b:95:45:fd:90:8e:af:ad:9f:51:b4:0a:b4:cf:7c:97:a2:8a:64:30:0b:8f
Signer

Actual PE Digest

39:95:04:b7:83:30:aa:59:26:52:7b:95:45:fd:90:8e:af:ad:9f:51:b4:0a:b4:cf:7c:97:a2:8a:64:30:0b:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dpx.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o__wsplitpath_s
_o_free
_o_malloc
_o_memcpy_s
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
_o_wcscpy_s
_o_wmemcpy_s
__CxxFrameHandler3
wcsstr
_except_handler4_common
_o__execute_onexit_table
_o__errno
_o__crt_atexit
strrchr
_o__configure_narrow_argv
strchr
_o__cexit
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memmove_s
wcsncmp
memset
strncmp

ntdll

NtClose
RtlDeleteCriticalSection
RtlComputeCrc32
DbgPrintEx
RtlRaiseStatus
VerSetConditionMask
RtlInitializeCriticalSection
RtlNtStatusToDosError

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
GetModuleHandleW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegOpenCurrentUser

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
CreateSemaphoreExW
SetEvent
WaitForSingleObject
ReleaseMutex
CreateEventW
WaitForSingleObjectEx
LeaveCriticalSection
OpenSemaphoreW
ReleaseSemaphore
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
ResetEvent

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualFree
VirtualAlloc
VirtualQuery

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

SetFileAttributesW
CreateFileW
SetFilePointerEx
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
GetFinalPathNameByHandleW
RemoveDirectoryW
LocalFileTimeToFileTime
DeleteFileW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetDiskFreeSpaceExW
FindFirstFileExW
FindClose
ReadFile
FindFirstFileW
GetFullPathNameW
FindNextFileW
CreateDirectoryW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemInfo
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyKey
CryptGetKeyParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDecrypt
CryptReleaseContext
CryptSetKeyParam
CryptGetHashParam
CryptImportKey

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-file-l2-1-0

CreateHardLinkW
MoveFileExW

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime
LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegOpenKeyW
RegDeleteKeyW
RegEnumKeyW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-0

GetProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-legacy-l1-1-0

PathMatchSpecW

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateGuid

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-localization-l1-2-0

LCMapStringW
FormatMessageW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

rpcrt4

UuidCreate

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventProviderEnabled

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
TraceEvent
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids

Exports

Exports

DpxCheckJobExists
DpxCheckJobExistsEx
DpxDeleteJob
DpxDeleteJobEx
DpxFreeMemory
DpxNewJob
DpxNewJobEx
DpxRestoreJob
DpxRestoreJobEx
DpxRestoreOrNewJob
DpxRestoreOrNewJobEx

Sections

.text
Size: 503KB - Virtual size: 503KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

613f21eb23fcfc692166bef7b0011936

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

39:95:04:b7:83:30:aa:59:26:52:7b:95:45:fd:90:8e:af:ad:9f:51:b4:0a:b4:cf:7c:97:a2:8a:64:30:0b:8fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

rpcrt4

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

Exports

Exports

Sections

.text Size: 503KB - Virtual size: 503KB

.data Size: 1KB - Virtual size: 7KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 17KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

39:95:04:b7:83:30:aa:59:26:52:7b:95:45:fd:90:8e:af:ad:9f:51:b4:0a:b4:cf:7c:97:a2:8a:64:30:0b:8f
Signer

.text
Size: 503KB - Virtual size: 503KB

.data
Size: 1KB - Virtual size: 7KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 17KB