fd2516f5a8dd9eaddac65f4bd8ae4ed6cba9e115ebe88c3f6d2f5e2cdd5e20a6[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

fd2516f5a8dd9eaddac65f4bd8ae4ed6cba9e115ebe88c3f6d2f5e2cdd5e20a6.dll
Size

296KB
MD5

2f05a4a116a3b152c2a5eabf048f43e8
SHA1

d18ef08bf13de20442613a899c4cd07b96d27f8c
SHA256

fd2516f5a8dd9eaddac65f4bd8ae4ed6cba9e115ebe88c3f6d2f5e2cdd5e20a6
SHA512

af0242ebdbe57c97b68c8bd04094b2a24849cb55c057adb43725ccf29941dc6dfefa5395a3b1563e843784e36635e4a365388fc435a16ed047d20d7ca226a3d1
SSDEEP

6144:xmz+XJXwEIrembe6/xeQ8Zwt1hp9SCBqAwkxadOXm23tZDHN:xmDE2VxeHZwt1hp95BUBXItNt

Score

N/A

Malware Config

Signatures

Files

fd2516f5a8dd9eaddac65f4bd8ae4ed6cba9e115ebe88c3f6d2f5e2cdd5e20a6.dll
.dll windows x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/04/2019, 00:00

Not After

10/04/2020, 23:59

Subject

CN=START ARCHITECTURE LTD,O=START ARCHITECTURE LTD,POSTALCODE=CV34 6RG,STREET=Lake View House Wilton Drive\, Tournament Fields,L=WARWICK,ST=WARWICK,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:d8:0e:dd:69:4d:0a:40:2a:a4:fe:80:8e:bf:b5:9f:f1:14:5d:5e
Signer

Actual PE Digest

4d:d8:0e:dd:69:4d:0a:40:2a:a4:fe:80:8e:bf:b5:9f:f1:14:5d:5e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=START ARCHITECTURE LTD,O=START ARCHITECTURE LTD,POSTALCODE=CV34 6RG,STREET=Lake View House Wilton Drive\, Tournament Fields,L=WARWICK,ST=WARWICK,C=GB

15/09/2022, 14:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
feast
foer
lopora

Sections

.text
Size: 281KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

09d0478591d4f788cb3e5ea416c25237

Code Sign

ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20Certificate

Extended Key Usages

Key Usages

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

4d:d8:0e:dd:69:4d:0a:40:2a:a4:fe:80:8e:bf:b5:9f:f1:14:5d:5eSigner

Signature Validations

Verification

15/09/2022, 14:52 Valid: false

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 281KB - Virtual size: 1.1MB

.rsrc Size: 9KB - Virtual size: 12KB

.reloc Size: 512B - Virtual size: 512B

ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20
Certificate

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

4d:d8:0e:dd:69:4d:0a:40:2a:a4:fe:80:8e:bf:b5:9f:f1:14:5d:5e
Signer

15/09/2022, 14:52
Valid: false

.text
Size: 281KB - Virtual size: 1.1MB

.rsrc
Size: 9KB - Virtual size: 12KB

.reloc
Size: 512B - Virtual size: 512B