if[.]bin[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
if.bin.dll
Size 1.8MB
Sample220201-sd17aagfd3
SHA256 abc91dfef90476ff6e3406b62b085ef1e84585aea3e9d80dbe3aa21597ff5995
MD5 d90f5bb9e103ea6935e453a8bafe4a66
SHA1 20b37f0d541542925ae321a6350b64a04abaa3b2
SHA512 f5be489c65295d22f70a101aff1a79cf6e9c01f0d3f00c1424a606e2d3c24c70d5eff79dac3cadfb9e5ebe4a1710dcb21e7536cde02a37e7b73b872e90b5fb88
SSDEEP 49152:VoTg5aw/AI3UTbiCPmHHUpnm+xOwSid7+:5/AI3MIMv4
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

if.bin.dll

.dll 1.8MB

if.bin.dll

SHA256 abc91dfef90476ff6e3406b62b085ef1e84585aea3e9d80dbe3aa21597ff5995
MD5 d90f5bb9e103ea6935e453a8bafe4a66
SHA1 20b37f0d541542925ae321a6350b64a04abaa3b2
SHA512 f5be489c65295d22f70a101aff1a79cf6e9c01f0d3f00c1424a606e2d3c24c70d5eff79dac3cadfb9e5ebe4a1710dcb21e7536cde02a37e7b73b872e90b5fb88
SSDEEP 49152:VoTg5aw/AI3UTbiCPmHHUpnm+xOwSid7+:5/AI3MIMv4
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

7b:10:a6:6c:b3:b2:47:03:b8:d2:c2:20:52:ef:06:0f:b1:f0:05:d6:5a:d9:24:87:6c:3e:95:ca:83:ab:7b:ae

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Subject

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145

Serial Number

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2019 - Oct 6, 2022

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

18885

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

92KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ancony

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.overanx

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.tinderl

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.uncleme

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.missend

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.euaster

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.puruha

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.goan

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.gowkedl

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.pilleus

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ