dxtrans[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dxtrans.dll
Size

309KB
MD5

40668716124b71e523a2a23ea60d3a20
SHA1

c03d2f6597ae7b25eafcbdd882b086637fb30384
SHA256

643380aa13d72cf1c9ca9c00e9d289999accfc2312463b89f9452163ce964547
SHA512

cb65992242acc50d840f05edf1d87648c07fe595992dcb5bd1cacfc1bb27f70b8a9ae5dda0c421134e63d27186892b939ec404fea56a7656b2d9c1ee3fb92640
SSDEEP

3072:GeYnzyo1CYwuoFDBHuXldvtfBNIDj6B4CHw42bjzUFLqTqt9DaJQqWiD+uvGCFl2:GPzsReBN6lCHw42jEDDUVeyk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dxtrans.dll

Files

dxtrans.dll
.dll regsvr32 windows:6 windows x64 arch:x64

dbbe81c7b1d7fa760c40ab4b80b89e88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxtrans.pdb

Imports

msvcrt

sinf
sqrt
_initterm
_amsg_exit
_XcptFilter
memset
__C_specific_handler
__dllonexit
_unlock
_lock
memcpy
cosf
ceilf
__CxxFrameHandler3
_onexit
floor
free
iswspace
wcschr
realloc
memcpy_s
_purecall
malloc
floorf
sqrtf

atl

ord30
ord15
ord32
ord21
ord16
ord23

kernel32

HeapAlloc
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
Sleep
TerminateProcess
LeaveCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsBadCodePtr
LoadLibraryW
IsBadReadPtr
GetCurrentThread
WaitForSingleObject
GetCurrentProcess
VirtualQuery
DeleteCriticalSection
DisableThreadLibraryCalls
IsBadWritePtr
InitializeCriticalSection
GetVersionExW
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetProcessHeap
GetCurrentDirectoryW
FreeLibrary
ResetEvent
ExitThread
QueueUserAPC
SetEvent
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForMultipleObjectsEx
CreateThread
CreateSemaphoreExW
CreateIoCompletionPort
CloseHandle
GetCurrentThreadId
VirtualProtect
GetSystemInfo
CreateEventW
CreateSemaphoreW
EnterCriticalSection
VirtualAlloc
GetProcAddress
GetLastError
ReleaseSemaphore
HeapFree
RtlVirtualUnwind

ole32

CoCreateInstance
CreateFileMoniker
CreateBindCtx
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantChangeTypeEx
LoadRegTypeLi
SysFreeString
SetErrorInfo
VariantChangeType
SysAllocStringLen
VariantInit
VariantCopy
VariantClear
SysStringLen
SysAllocString

user32

SetRect
GetDesktopWindow
GetDC
IntersectRect
ReleaseDC
IsCharAlphaW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegGetValueW

gdi32

StrokeAndFillPath
StrokePath
FillPath
CreateFontIndirectW
GetObjectW
CreateCompatibleDC
SetMapMode
DeleteDC
GetPaletteEntries
DeleteObject
GetTextMetricsW
GetGlyphOutlineW
GetKerningPairsW
BitBlt
CreateBrushIndirect
BeginPath
MoveToEx
LineTo
PolyBezierTo
EndPath
ExtCreatePen
SelectObject
SetPolyFillMode

iertutil

ord172
ord701

shlwapi

ord158
StrCmpNIW
StrCmpIW
ord154

urlmon

ord414
ord462

Exports

Exports

?DXConstOverArray@@YAXPEAVDXPMSAMPLE@@AEBV1@K@Z
?DXConstUnderArray@@YAXPEAVDXPMSAMPLE@@AEBV1@K@Z
?DXDitherArray@@YAXPEBUDXDITHERDESC@@@Z
?DXLinearInterpolateArray@@YAXPEBVDXBASESAMPLE@@PEAUDXLIMAPINFO@@PEAV1@K@Z
?DXOverArray@@YAXPEAVDXPMSAMPLE@@PEBV1@K@Z
?DXOverArrayMMX@@YAXPEAVDXPMSAMPLE@@PEBV1@K@Z
DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbbe81c7b1d7fa760c40ab4b80b89e88

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

kernel32

ole32

oleaut32

user32

advapi32

gdi32

iertutil

shlwapi

urlmon

Exports

Exports

Sections

.text Size: 245KB - Virtual size: 244KB

.data Size: 9KB - Virtual size: 13KB

.pdata Size: 11KB - Virtual size: 11KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 34KB - Virtual size: 33KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 245KB - Virtual size: 244KB

.data
Size: 9KB - Virtual size: 13KB

.pdata
Size: 11KB - Virtual size: 11KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 3KB - Virtual size: 2KB