SNLog[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SNLog.dll
Size

146KB
MD5

add3606b2c90455d77f2f7673b0c31da
SHA1

e199ac34cf09723ff80f1135528c84de92e2d897
SHA256

e7b91dd8ab60d63bee3adf414c7a9c9e1675eeecd21c2269bfac878a80634272
SHA512

24fde972dc5e11025a311f8ad9e06a3c284f89e1b9d60d86590b7f48ae2300aeb2ab57e6e82c0a50d1522d9f620c3b2768bd96908d5774dcf3d184bedd1988bf
SSDEEP

3072:idYKIuCY7UinnbJVpJntpXY15EYsqPQ1Gp:wggJ/NYIgPQ1o

Score

N/A

Malware Config

Signatures

Files

SNLog.dll
.dll windows x86

0a03a4d3f7f6de502298237780b67d3f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

09/11/2004, 00:00

Not After

21/11/2005, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

49:93:8a:c8:8c:4e:ac:63:88:f7:0c:ec:80:2d:8c:cd:9a:c7:08:cf
Signer

Actual PE Digest

49:93:8a:c8:8c:4e:ac:63:88:f7:0c:ec:80:2d:8c:cd:9a:c7:08:cf

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

15/12/2022, 13:51
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Destroy
ImageList_LoadImageA

wsock32

getservbyport
htons

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentThread
GetCurrentProcess
SetLastError
OpenProcess
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
GetWindowsDirectoryA
GetFileAttributesA
DisableThreadLibraryCalls
lstrcpyA
LocalAlloc
FormatMessageA
GetProcAddress
LoadLibraryA
lstrcatA
GetSystemDirectoryA
FreeLibrary
LocalFree
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleA
OutputDebugStringA
GetTickCount
QueryPerformanceCounter
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
LeaveCriticalSection
EnterCriticalSection

user32

GetWindowThreadProcessId
SetTimer
KillTimer
wsprintfA
LoadStringA
CharNextA
GetShellWindow
GetDesktopWindow

ole32

OleRun
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantClear
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime

nisres

IsPermissionEnabled

msvcp71

?_Nomemory@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr71

strncpy
_itoa
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__security_error_handler
_callnewh
memset
_splitpath
_stricmp
malloc
free
_except_handler3
_CxxThrowException
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??_V@YAXPAX@Z
_purecall
_mbsnbcpy
memmove
_mbsstr
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
_vsnprintf
_strdup
_snprintf
_mbscmp

Exports

Exports

GetFactory
GetLVPluginObject
GetObjectCount

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a03a4d3f7f6de502298237780b67d3f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2Certificate

Extended Key Usages

Key Usages

49:93:8a:c8:8c:4e:ac:63:88:f7:0c:ec:80:2d:8c:cd:9a:c7:08:cfSigner

Signature Validations

Verification

15/12/2022, 13:51 Valid: false

Headers

File Characteristics

Imports

comctl32

wsock32

kernel32

user32

ole32

oleaut32

nisres

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 81KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 9KB - Virtual size: 11KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 14KB - Virtual size: 14KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

49:93:8a:c8:8c:4e:ac:63:88:f7:0c:ec:80:2d:8c:cd:9a:c7:08:cf
Signer

15/12/2022, 13:51
Valid: false

.text
Size: 82KB - Virtual size: 81KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 9KB - Virtual size: 11KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 14KB - Virtual size: 14KB