ccL40[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ccL40.dll
Size

369KB
MD5

24aa6d05bf9b0fb50d7c539ba885a1d7
SHA1

95072636239e9c2d194fdc37c4a2bc1bc1e8e92c
SHA256

a76ea2a61aafbcb041e83d79daa265a34480c219c8983f3fdc5be1235fde555b
SHA512

3e68396994b38b3024e28f1b290a5b8a5440b0b8d6d56399be69ec29b894f978436e58425d0e84633861c2eae028319b558e4883c7791cc063dfba90a1906949
SSDEEP

6144:L8AsFCkAc8cKG+PVFL+Ta4rwWGIoaH7EANJlxww0LtZoaVJajYSUu8xw8cCJ1:L8AsFCVc8cKG+P3LN4rwdIoaHgANJnwp

Score

N/A

Malware Config

Signatures

Files

ccL40.dll
.dll windows x86

55c911e77371bf6ee619f9f98e8472f2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

09/11/2004, 00:00

Not After

21/11/2005, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:b4:92:86:41:15:a1:cb:f3:6d:28:c0:da:47:4c:52:c2:3f:17:84
Signer

Actual PE Digest

52:b4:92:86:41:15:a1:cb:f3:6d:28:c0:da:47:4c:52:c2:3f:17:84

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

15/12/2022, 14:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisableThreadLibraryCalls
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
GetProcAddress
FreeLibrary
InterlockedIncrement
GetCurrentThreadId
GetTickCount
InterlockedDecrement
LoadLibraryExA
lstrcatA
InterlockedExchangeAdd
GetModuleFileNameA
LoadLibraryA
GetSystemDirectoryA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetLocalTime
WriteFile
ReadFile
GetCommandLineA
GetConsoleTitleA
GetNumberOfConsoleInputEvents
ReadConsoleInputA
SetConsoleTitleA
FreeConsole
SetConsoleMode
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleScreenBufferInfo
GetStdHandle
AllocConsole
SetStdHandle
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
WriteConsoleOutputCharacterA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleCursorInfo
GetConsoleCursorInfo
SetConsoleWindowInfo
CreateConsoleScreenBuffer
SetConsoleActiveScreenBuffer
WriteConsoleA
lstrcpyA
TerminateProcess
GetCurrentProcess
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetThreadContext
GetCurrentThread
CloseHandle
SetFilePointer
CreateFileA
OutputDebugStringA
SetEvent
PulseEvent
ResetEvent
CreateEventA
OpenEventA
SetUnhandledExceptionFilter
FlushFileBuffers
GetFileSize
SetEndOfFile
DeleteFileA
CreateDirectoryA
GetFileAttributesA
DuplicateHandle
GetModuleHandleA
SetLastError
HeapFree
GetProcessHeap
VirtualFree
HeapSize
HeapAlloc
VirtualAlloc
GetSystemInfo
HeapReAlloc
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
ReleaseMutex
CreateMutexA
OpenMutexA
LocalAlloc
FormatMessageA
ReleaseSemaphore
CreateSemaphoreA
OpenSemaphoreA
SetErrorMode
CancelIo
GetWindowsDirectoryA
GetLongPathNameA
GetShortPathNameA
OpenProcess
GetSystemTime
SuspendThread
ResumeThread
SetThreadPriority
GetThreadPriority
ExitThread
CreateThread
TerminateThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
ExitProcess
HeapDestroy
LocalFree

user32

CreateWindowExA
CharNextA
CharPrevA
PostThreadMessageA
UnregisterClassA
GetSystemMetrics
MsgWaitForMultipleObjectsEx
PeekMessageA
IsWindowUnicode
GetMessageW
DispatchMessageW
GetClassInfoExA
RegisterClassExA
wsprintfA
GetWindowLongA
DefWindowProcA
SetWindowLongA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostMessageA

ole32

OleLoadFromStream
CreateStreamOnHGlobal
GetHGlobalFromStream
OleSaveToStream
CoInitializeEx
CoUninitialize
CoCreateInstance
CoFreeUnusedLibraries

oleaut32

SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayLock
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnlock
SafeArrayRedim
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
VariantCopyInd
SafeArrayPtrOfIndex

msvcp71

?sync_with_stdio@ios_base@std@@SA_N_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Nomemory@std@@YAXXZ

msvcr71

_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_callnewh
_beginthreadex
_mbsnbicmp
vswprintf
_vscwprintf
wcschr
_endthreadex
__security_error_handler
_set_security_error_handler
_set_purecall_handler
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
??_V@YAXPAX@Z
_splitpath
__CppXcptFilter
_open_osfhandle
_fdopen
_iob
wcslen
memcmp
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_mbscmp
strlen
memmove
memcpy
vsprintf
_vscprintf
_mbscspn
_mbsicmp
_mbsinc
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
_purecall
_mbsstr
_mbschr
_mbsspn
sscanf
memset
malloc
free
_resetstkoflw
_except_handler3
_CxxThrowException
__CxxFrameHandler

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55c911e77371bf6ee619f9f98e8472f2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2Certificate

Extended Key Usages

Key Usages

52:b4:92:86:41:15:a1:cb:f3:6d:28:c0:da:47:4c:52:c2:3f:17:84Signer

Signature Validations

Verification

15/12/2022, 14:00 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

msvcp71

msvcr71

Sections

.text Size: 208KB - Virtual size: 207KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 18KB - Virtual size: 17KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

52:b4:92:86:41:15:a1:cb:f3:6d:28:c0:da:47:4c:52:c2:3f:17:84
Signer

15/12/2022, 14:00
Valid: false

.text
Size: 208KB - Virtual size: 207KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 18KB - Virtual size: 17KB