1[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.dll
Size 629KB
Sample220204-rs1cvsbbgk
SHA256 9a09137e28cc0e5af606db45d95f1fb46e1024129eb065e2d854c7aecda82ba0
MD5 a347ee429c92e27439ae9bcf37cb420d
SHA1 c22e71d80e127a45c226698a81272d193b5d225d
SHA512 04ce98934dd6a3db162febe968a12a1097e4db3b92217a03f9f5a46ceaf1fce3ca2d8fe4630939740fbcc87fd9af9bd4fac0dad255880a4d85b8eb8d80570285
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

1.dll

.dll 629KB

1.dll

IMPHASH 01f87ec9e1e36146b71b7ffce4fd5fa9
SHA256 9a09137e28cc0e5af606db45d95f1fb46e1024129eb065e2d854c7aecda82ba0
MD5 a347ee429c92e27439ae9bcf37cb420d
SHA1 c22e71d80e127a45c226698a81272d193b5d225d
SHA512 04ce98934dd6a3db162febe968a12a1097e4db3b92217a03f9f5a46ceaf1fce3ca2d8fe4630939740fbcc87fd9af9bd4fac0dad255880a4d85b8eb8d80570285
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

PE Signature issue

Digest

55:db:57:15:29:47:13:a4:84:a0:ea:08:84:db:0e:c9:ba:7e:10:59

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=4koncepty bar s.r.o. ,OU=IT Dept.,O=4koncepty bar s.r.o. ,ST=Olomoucký kraj,C=CZ

Serial Number

fb:92:42:43:e1:af:04:45:83:dc:81:da:5d:93:f6:7c

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2022 - Feb 1, 2023

Minor OS version

Major OS version

Entry point

132996

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetThreadUILanguage AreFileApisANSI GetThreadErrorMode GetCurrentProcessorNumber GetCommandLineW GetTickCount IsSystemResumeAutomatic IsDebuggerPresent GetACP SwitchToThread GetLastError TlsAlloc GetCommandLineA UnregisterApplicationRestart FlushProcessWriteBuffers GetCurrentThreadId GetSystemDefaultUILanguage RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer MultiByteToWideChar LoadResource SizeofResource FindResourceW GetModuleHandleW GetProcAddress LoadLibraryExW GetEnvironmentStringsW lstrcmpiW FreeLibrary WriteConsoleW CreateFileW ReadConsoleW SetStdHandle FreeEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetProcessHeap SetFileApisToOEM CloseHandle ReadFile FindClose GetTickCount64 GetModuleFileNameW LoadLibraryA HeapFree HeapReAlloc HeapAlloc GetModuleHandleExW ExitProcess InterlockedFlushSList RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EncodePointer SetLastError

user32

IsProcessDPIAware GetForegroundWindow CreateMenu GetMenuCheckMarkDimensions CloseClipboard GetCapture GetKBCodePage GetMessageTime AnyPopup EmptyClipboard InSendMessage GetMessageExtraInfo GetClipboardSequenceNumber GetFocus SetCursor LoadCursorW CharNextW GetActiveWindow GetOpenClipboardWindow

advapi32

RegSetValueExW RegEnumKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW

ole32

CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoFreeUnusedLibraries CoTaskMemRealloc

oleaut32

VarUI4FromStr

wininet

InternetQueryDataAvailable

Name

.text

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ