dpclat[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dpclat.exe
Size

294KB
MD5

513d270678daa215c06aac55b68b5af8
SHA1

64147a7a2fd972f2ceb61d5935eb4cd2b8a10cdd
SHA256

617c8ce3055cb3ca48c1e8f7608b350eed64b6b73439f3c799739a7d54f2a4d2
SHA512

615bcbb58059215e0ab1374eb05df80ac378a9ec903b643a74686a0374f2440e555e83204360be1a4306e8d3de68f672f7a64646cae6a59548740a194b3fbad7
SSDEEP

3072:qjW67z9vEcuXoyo8NhVzp+4dRu0ebL4wNSRVdBTSRtxRupDtLsgK6j7kfss3/l:qFsG8jnfWbQRVdxSlEDtLDKGkl

Score

1^/10

Malware Config

Signatures

Files

dpclat.exe
.exe windows:4 windows x86 arch:x86

6109c06809e7a16475b9b07ee9115652

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:f2:87:99:08:59:03:45:eb:7f:c6:66:70:ed:c8:30
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/09/2009, 00:00

Not After

10/12/2012, 23:59

Subject

CN=Thesycon Systemsoftware & Consulting GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Thesycon Systemsoftware & Consulting GmbH,L=Ilmenau,ST=Thuringia,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a4:20:7e:8f:8f:8f:96:81:80:c5:c5:3a:a8:44:4a:9a:5a:d2:14:e6
Signer

Actual PE Digest

a4:20:7e:8f:8f:8f:96:81:80:c5:c5:3a:a8:44:4a:9a:5a:d2:14:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetFileType
SetHandleCount
GetStdHandle
ExitProcess
HeapCreate
HeapDestroy
GetConsoleMode
GetConsoleCP
WriteFile
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryExA
FlushFileBuffers
SetEndOfFile
lstrcpyA
MulDiv
DeleteCriticalSection
lstrcpynA
CompareStringA
InitializeCriticalSection
lstrcpynW
GetCurrentThreadId
FlushInstructionCache
GetModuleFileNameA
IsDBCSLeadByte
EnterCriticalSection
SetLastError
CreateMutexA
MultiByteToWideChar
InterlockedIncrement
GetVersionExA
lstrlenW
RaiseException
lstrcmpiA
SetStdHandle
WideCharToMultiByte
LeaveCriticalSection
GetCurrentProcessId
lstrcmpA
FreeLibrary
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetSystemDirectoryA
Sleep
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
DeviceIoControl
GetOverlappedResult
ReadFile
GetLastError
CreateFileA
CloseHandle
CreateEventA
InterlockedDecrement
lstrlenA
OutputDebugStringA
RtlUnwind
DebugBreak

user32

SetMenuDefaultItem
RegisterWindowMessageA
CharLowerA
LoadAcceleratorsA
SetFocus
EndDialog
LoadMenuA
GetWindowDC
LoadBitmapA
CreateDialogParamA
PostQuitMessage
IsDialogMessageA
DestroyWindow
IsMenu
GetWindowTextA
UnhookWindowsHookEx
CreateWindowExA
WindowFromPoint
FillRect
ReleaseCapture
GetSubMenu
SetForegroundWindow
SendMessageA
ShowWindow
LoadStringW
GetWindowThreadProcessId
GetMenuItemCount
SetMenu
DrawTextA
GetCapture
SetWindowTextA
IsIconic
GetDlgCtrlID
InflateRect
OffsetRect
IsWindowEnabled
CreatePopupMenu
SetRectEmpty
SetDlgItemTextA
IsWindow
IsWindowVisible
GetSysColor
GetLastActivePopup
GetMenuItemInfoA
MoveWindow
SetMenuItemInfoA
GetClassNameA
GetFocus
AppendMenuA
FindWindowA
GetCursorPos
DrawFocusRect
MessageBeep
KillTimer
GetKeyState
ScreenToClient
TranslateAcceleratorA
UpdateWindow
PeekMessageA
LoadCursorA
GetMessageA
GetMenu
DrawEdge
wsprintfA
TranslateMessage
GetDC
DispatchMessageA
SetWindowsHookExA
FrameRect
GetClassInfoExA
DestroyMenu
ReleaseDC
LoadImageA
ModifyMenuA
MonitorFromPoint
RegisterClassExA
GetWindow
PtInRect
CallNextHookEx
GetDlgItem
GetMonitorInfoA
SetTimer
GetSysColorBrush
SystemParametersInfoA
SetCursor
DialogBoxParamA
TrackPopupMenuEx
GetWindowRect
GetActiveWindow
MapWindowPoints
GetWindowTextLengthA
RemoveMenu
GetSystemMetrics
DrawFrameControl
GetMessagePos
PostMessageA
MessageBoxA
EndPaint
InvalidateRect
LoadStringA
BeginPaint
GetClientRect
RedrawWindow
DefWindowProcA
GetWindowLongA
SetWindowLongA
CharNextA
wvsprintfA
CallWindowProcA
SetWindowPos
GetParent
SetCapture
UnregisterClassA

gdi32

CreateDIBSection
CreateBitmap
GetStockObject
CreatePatternBrush
GetObjectA
CreateFontIndirectA
SetBrushOrgEx
PatBlt
SelectObject
SetTextColor
SetBkMode
IntersectClipRect
MoveToEx
CreatePen
LineTo
TextOutA
CreateCompatibleDC
SetBkColor
ExtTextOutA
CreateCompatibleBitmap
BitBlt
DeleteDC
GetTextExtentPoint32A
DeleteObject

advapi32

OpenServiceA
DeleteService
ControlService
StartServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCloseKey
FreeSid
CheckTokenMembership
RegQueryValueExA
RegDeleteKeyA
AllocateAndInitializeSid
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA

shell32

ShellExecuteA

ole32

CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoInitialize

oleaut32

VarUI4FromStr

comctl32

ImageList_Destroy
ImageList_Draw
ord6
InitCommonControlsEx
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Create
_TrackMouseEvent

Sections

.text
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6109c06809e7a16475b9b07ee9115652

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

12:f2:87:99:08:59:03:45:eb:7f:c6:66:70:ed:c8:30Certificate

Extended Key Usages

Key Usages

a4:20:7e:8f:8f:8f:96:81:80:c5:c5:3a:a8:44:4a:9a:5a:d2:14:e6Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

Sections

.text Size: 168KB - Virtual size: 165KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 12KB - Virtual size: 16KB

.rsrc Size: 68KB - Virtual size: 67KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

12:f2:87:99:08:59:03:45:eb:7f:c6:66:70:ed:c8:30
Certificate

a4:20:7e:8f:8f:8f:96:81:80:c5:c5:3a:a8:44:4a:9a:5a:d2:14:e6
Signer

.text
Size: 168KB - Virtual size: 165KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 68KB - Virtual size: 67KB