dpx[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dpx.dll
Size

329KB
MD5

2798c06ab46b4d1defdf6b4a7022cc1b
SHA1

99d86fe1f5db1440192d351f6a2b74bc78ee3f7e
SHA256

7aea788e782a68914e730e5288cbfc3e217c22b584a8d20d04a81692bc03a6f8
SHA512

45fb0e90cee2d666977e04a664ce04886ea83af4968ce06dbe3518c0f13bc2dda522b02eb7f331683175b53f3372eba233a7dd0ec1f46d7dcdf3d8479600aa04
SSDEEP

6144:0iU82n2v8yTdxVTdQ/jmLwbNjvOEK7uyQefU:FNBia3vU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dpx.dll

Files

dpx.dll
.dll windows:6 windows x64 arch:x64

d5ebd226c9e2995169afe3afebecd1a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dpx.pdb

Imports

msvcrt

_purecall
_vscwprintf
vswprintf_s
?terminate@@YAXXZ
_onexit
__dllonexit
_vsnwprintf
_unlock
free
_lock
swprintf_s
_vsnprintf
wcsstr
malloc
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_XcptFilter
_amsg_exit
memcmp
memcpy
memset
_CxxThrowException
__CxxFrameHandler3

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
LeaveCriticalSection
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection

api-ms-win-core-file-l1-1-0

FindNextFileW
GetFullPathNameW
FindFirstFileW
DeleteFileW
SetFilePointer
GetFileSize
GetLongPathNameW
LocalFileTimeToFileTime
CreateFileW
SetEndOfFile
WriteFile
FindClose
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
SetFilePointerEx
ReadFile
GetFileSizeEx
SetFileTime

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExA
GetProcAddress
FreeLibrary
GetModuleHandleW

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW
DosDateTimeToFileTime

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-security-cryptoapi-l1-1-0

CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegCreateKeyW
RegOpenKeyW
RegEnumKeyW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

rpcrt4

UuidCreate

api-ms-win-eventing-controller-l1-1-0

ControlTraceW

api-ms-win-eventing-classicprovider-l1-1-0

TraceEvent
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc

Exports

Exports

DpxFreeMemory
DpxNewJob
DpxNewJobEx
DpxRestoreJob
DpxRestoreJobEx

Sections

.text
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5ebd226c9e2995169afe3afebecd1a1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

rpcrt4

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

Exports

Exports

Sections

.text Size: 305KB - Virtual size: 304KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 12KB - Virtual size: 11KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 305KB - Virtual size: 304KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 12KB - Virtual size: 11KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB