Dec2SS[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Dec2SS.dll
Size

93KB
MD5

1ace3c209ee49287ff358bb3a2f4fb90
SHA1

757dc1c45d285b39c5979266168631855d816b69
SHA256

011856dc327615a07550033f2f7e03fd415f71cd2c88bcfad4dfae1cec9ed195
SHA512

2e30e96a0a4b423e7954244ff9fa8934323556659a5e2dd86feda327889052768e95fedcb4e32965f08e86bdb4324edfe45a66a62a1b2ef6c8e2a831366e1175
SSDEEP

1536:0HohfB21Mz0C+vVDPKOEHISM1KEC2xmOGx3Id93VnVkfF3fi6xi1/4:SohfU1Mz0xvxKOUISMkjKmdxO3VnVI3h

Score

N/A

Malware Config

Signatures

Files

Dec2SS.dll
.dll windows x86

55c0d574a0da58f477bfe97b10283329

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

09/11/2004, 00:00

Not After

21/11/2005, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:38:2c:40:e6:a9:89:00:90:c3:52:a3:84:31:9d:f1:a0:e3:6c:7b
Signer

Actual PE Digest

0a:38:2c:40:e6:a9:89:00:90:c3:52:a3:84:31:9d:f1:a0:e3:6c:7b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

15/12/2022, 13:55
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharToOemBuffA
OemToCharBuffA

msvcrt

malloc
free
??2@YAPAXI@Z
strrchr
__CxxFrameHandler
strncpy
_purecall
_CxxThrowException
sprintf
calloc
strncat
strchr
_setmaxstdio
clearerr
fclose
fflush
fgetc
fgets
fopen
fputc
fputs
realloc
??3@YAXPAX@Z
ftell
fwrite
remove
fseek
rewind
setvbuf
_close
_fstat
_open
_stat
_utime
ungetc
_vsnprintf
tolower
mblen
__mb_cur_max
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
_onexit
fread
rename
_chmod
_access
_fileno
_chsize

kernel32

GetTempPathA
DisableThreadLibraryCalls
WideCharToMultiByte

Exports

Exports

?DecDeleteEngine@@YAJPAVIDecEngine@@@Z
?DecDeleteSSEngine@@YAJPAVIDecEngine@@@Z
?DecNewEngine@@YAJPAPAVIDecEngine@@@Z
?DecNewSSEngine@@YAJPAPAVIDecEngine@@@Z

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55c0d574a0da58f477bfe97b10283329

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2Certificate

Extended Key Usages

Key Usages

0a:38:2c:40:e6:a9:89:00:90:c3:52:a3:84:31:9d:f1:a0:e3:6c:7bSigner

Signature Validations

Verification

15/12/2022, 13:55 Valid: false

Headers

File Characteristics

Imports

user32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 16KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 888B

.reloc Size: 4KB - Virtual size: 3KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

0a:38:2c:40:e6:a9:89:00:90:c3:52:a3:84:31:9d:f1:a0:e3:6c:7b
Signer

15/12/2022, 13:55
Valid: false

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 16KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 888B

.reloc
Size: 4KB - Virtual size: 3KB