dcapi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dcapi.dll
Size

207KB
MD5

feeb542d5c6e0c3766e9504df4d7350a
SHA1

f6dafef2bd0b0d5313b14c7dee02fa8001243df9
SHA256

8ecd127bf6f2ce953af5eccaf99671e162f75dec71cec58ef6c2259352f21e4b
SHA512

e1b11c98eb046b8e46b7cff7314fcd155ba8a23ffcf4b4b619e729378a3fd9e3fe5caa3ea954b54b03d97081fcb6b255185bc3bed03d1ec6f94f864a58b449f2
SSDEEP

6144:XJOXgVvT/irENNW/nNU9ra0qqDL0cVFnAiLpXq:Ms/uE9raRqnZFnAiL5q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcapi.dll

Files

dcapi.dll
.dll windows:5 windows x64 arch:x64

bb887b40f959cc204e54701ff15e571e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
RegCreateKeyW
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegFlushKey
RegCloseKey
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom

user32

GetMessageTime
GetClipboardOwner
SetWindowsHookExW
GetCursor
GetActiveWindow
GetCaretPos
GetDesktopWindow
GetWindowTextW
GetInputState
GetCursorInfo
GetGUIThreadInfo
GetWindowThreadProcessId
GetKBCodePage
GetCapture
GetQueueStatus
EnumWindows
GetClientRect
GetWindowInfo
CallNextHookEx
GetFocus
GetLastActivePopup
GetWindowRect
GetForegroundWindow
GetOpenClipboardWindow
GetShellWindow

psapi

GetProcessMemoryInfo

msvcrt

__C_specific_handler
memset
memcpy
wcsncpy
malloc
free
_vsnwprintf
wcsrchr
memmove
wcschr
isprint
tolower
isspace
_snwprintf
mbstowcs
_XcptFilter
_amsg_exit
calloc
_initterm
floor

kernel32

GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetThreadTimes
GetCurrentProcessId
GetCurrentThreadId
GetOEMCP
GlobalMemoryStatusEx
GetProcessTimes
GetProcessHeap
GetCurrentThread
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
VirtualLock
GetProcAddress
VirtualUnlock
GetVersionExW
LoadLibraryW
GetCurrentProcess
FreeLibrary
VirtualQuery
SetEndOfFile
SetFilePointer
GetFileSize
FindNextFileW
FindClose
FindFirstFileW
GlobalAddAtomW
GetVersion
GetModuleFileNameW
GetFileAttributesW
CopyFileW
GetSystemDirectoryW
FindFirstVolumeW
FindNextVolumeW
DeleteVolumeMountPointW
TlsSetValue
FindVolumeClose
DeviceIoControl
TlsFree
TlsAlloc
LockResource
SizeofResource
LoadResource
FindResourceW
TlsGetValue
CreateMutexW
DeleteFileW
CloseHandle
VirtualAlloc
GetLastError
GetFileSizeEx
CreateFileW
ReadFile
WriteFile
VirtualFree
Sleep

Exports

Exports

dc_add_keyfiles
dc_add_password
dc_backup_header
dc_benchmark
dc_change_password
dc_dec_step
dc_device_control
dc_disk_close
dc_disk_open
dc_disk_read
dc_disk_write
dc_done_format
dc_dsk_get_size
dc_enc_step
dc_encrypt_iso_image
dc_extract_rsrc
dc_first_volume
dc_format_byte_size
dc_format_fs
dc_format_step
dc_get_boot_device
dc_get_boot_disk
dc_get_bsod
dc_get_cipher_name
dc_get_device_status
dc_get_drive_info
dc_get_hw_name
dc_get_mbr_config
dc_get_version
dc_install_driver
dc_is_driver_installed
dc_is_driver_works
dc_is_old_runned
dc_load_config
dc_make_iso
dc_make_pxe
dc_mbr_config_by_partition
dc_mount_all
dc_mount_volume
dc_next_volume
dc_open_device
dc_remove_driver
dc_restore_header
dc_save_config
dc_set_boot
dc_set_mbr
dc_set_mbr_config
dc_start_decrypt
dc_start_encrypt
dc_start_format
dc_start_re_encrypt
dc_sync_enc_state
dc_unmount_all
dc_unmount_volume
dc_unset_mbr
dc_update_boot
dc_update_driver
enable_privilege
is_admin
is_win_vista
is_wow64
load_file
rnd_init
rnd_reseed_now
save_file
secure_alloc
secure_free

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb887b40f959cc204e54701ff15e571e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

psapi

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 9KB - Virtual size: 10KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 512B - Virtual size: 384B

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 9KB - Virtual size: 10KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 512B - Virtual size: 384B