if[.]bin[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

if.bin.dll
Size

1.8MB
MD5

d90f5bb9e103ea6935e453a8bafe4a66
SHA1

20b37f0d541542925ae321a6350b64a04abaa3b2
SHA256

abc91dfef90476ff6e3406b62b085ef1e84585aea3e9d80dbe3aa21597ff5995
SHA512

f5be489c65295d22f70a101aff1a79cf6e9c01f0d3f00c1424a606e2d3c24c70d5eff79dac3cadfb9e5ebe4a1710dcb21e7536cde02a37e7b73b872e90b5fb88
SSDEEP

49152:VoTg5aw/AI3UTbiCPmHHUpnm+xOwSid7+:5/AI3MIMv4

Score

N/A

Malware Config

Signatures

Files

if.bin.dll
.dll windows x86

Code Sign

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07-10-2019 00:00

Not After

06-10-2022 23:59

Subject

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:10:a6:6c:b3:b2:47:03:b8:d2:c2:20:52:ef:06:0f:b1:f0:05:d6:5a:d9:24:87:6c:3e:95:ca:83:ab:7b:ae
Signer

Actual PE Digest

7b:10:a6:6c:b3:b2:47:03:b8:d2:c2:20:52:ef:06:0f:b1:f0:05:d6:5a:d9:24:87:6c:3e:95:ca:83:ab:7b:ae

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145

28-01-2022 14:04
Valid: true

Chain 1

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

LXWSHMPNSLEIGKL

Sections

.text
Size: 92KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ancony
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_MEM_READ

.overanx
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_MEM_READ

.tinderl
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_MEM_READ

.uncleme
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_MEM_READ

.missend
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_MEM_READ

.euaster
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_MEM_READ

.puruha
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_MEM_READ

.goan
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_MEM_READ

.gowkedl
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_MEM_READ

.pilleus
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

7b:10:a6:6c:b3:b2:47:03:b8:d2:c2:20:52:ef:06:0f:b1:f0:05:d6:5a:d9:24:87:6c:3e:95:ca:83:ab:7b:aeSigner

Signature Validations

Verification

28-01-2022 14:04 Valid: true

Chain 1

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 155KB

.ancony Size: 158KB - Virtual size: 157KB

.overanx Size: 184KB - Virtual size: 184KB

.tinderl Size: 187KB - Virtual size: 186KB

.uncleme Size: 167KB - Virtual size: 166KB

.missend Size: 157KB - Virtual size: 157KB

.euaster Size: 158KB - Virtual size: 158KB

.puruha Size: 177KB - Virtual size: 177KB

.goan Size: 162KB - Virtual size: 162KB

.gowkedl Size: 184KB - Virtual size: 183KB

.pilleus Size: 179KB - Virtual size: 179KB

.rdata Size: 3KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

7b:10:a6:6c:b3:b2:47:03:b8:d2:c2:20:52:ef:06:0f:b1:f0:05:d6:5a:d9:24:87:6c:3e:95:ca:83:ab:7b:ae
Signer

28-01-2022 14:04
Valid: true

.text
Size: 92KB - Virtual size: 155KB

.ancony
Size: 158KB - Virtual size: 157KB

.overanx
Size: 184KB - Virtual size: 184KB

.tinderl
Size: 187KB - Virtual size: 186KB

.uncleme
Size: 167KB - Virtual size: 166KB

.missend
Size: 157KB - Virtual size: 157KB

.euaster
Size: 158KB - Virtual size: 158KB

.puruha
Size: 177KB - Virtual size: 177KB

.goan
Size: 162KB - Virtual size: 162KB

.gowkedl
Size: 184KB - Virtual size: 183KB

.pilleus
Size: 179KB - Virtual size: 179KB

.rdata
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB