SymLTCOM[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SymLTCOM.dll
Size

153KB
MD5

069586d05913bbccb44e2b98193af855
SHA1

059a54f4f32bef3af067522da7074db252e50451
SHA256

7297d4b414a26e008ef03989f0eba3fca9b2b1aebea9b15406d61862f5c06255
SHA512

29d1b6d63f559777cc89ca7c52916bf0cc140f4e0c332fea3ff7358c0076c2b92eca3c4303ce828d07d240be0f2c5872da9dd504d61d4694de61b1d4a279fcc8
SSDEEP

3072:JS9HQzSG8ofa9T4N3EqGveXagauV81Ssj+7Im6g+lpF:JS66obaduxsjm6g4

Score

N/A

Malware Config

Signatures

Files

SymLTCOM.dll
.dll regsvr32 windows x86

6710c264ad2124a056e44d05a439ccd2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

09/11/2004, 00:00

Not After

21/11/2005, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c0:d2:c3:52:03:10:57:87:a9:eb:b6:43:95:86:ee:4f:91:4a:e8:c3
Signer

Actual PE Digest

c0:d2:c3:52:03:10:57:87:a9:eb:b6:43:95:86:ee:4f:91:4a:e8:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

15/12/2022, 14:03
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCrackUrlA

kernel32

InterlockedDecrement
FreeLibrary
LoadLibraryExA
GetProcAddress
GetModuleFileNameA
lstrcpynA
IsDBCSLeadByte
GetModuleHandleA
lstrcpyA
lstrcatA
GetCurrentThreadId
GetCurrentProcessId
GetLocalTime
lstrcmpA
LocalAlloc
HeapFree
GetProcessHeap
ReleaseMutex
CloseHandle
GetTickCount
WaitForMultipleObjects
OpenMutexA
CreateMutexA
MulDiv
HeapAlloc
FlushInstructionCache
GetCurrentProcess
LoadLibraryA
LocalFree
InterlockedExchange
GetSystemTimeAsFileTime
QueryPerformanceCounter
ExitProcess
HeapSize
HeapReAlloc
HeapDestroy
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement

user32

UnregisterClassA
SystemParametersInfoA
CharNextA
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
RegisterClassExA
GetClassInfoExA
LoadCursorA
wsprintfA
CreateWindowExA
GetParent
SetFocus
ShowWindow
GetFocus
IsChild
BeginPaint
GetClientRect
EndPaint
InvalidateRect
IsWindow
CallWindowProcA
GetWindowLongA
SetWindowLongA
GetDC
ReleaseDC
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
DefWindowProcA
DestroyWindow
GetKeyboardType

gdi32

CreateDCA
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateRectRgnIndirect
SetTextAlign
TextOutA

advapi32

RegQueryValueExA
RegEnumKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey

ole32

CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateOleAdviseHolder
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

oleaut32

OleCreatePropertyFrame
VariantInit
VariantClear
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
SysAllocString
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysFreeString
UnRegisterTypeLi

shlwapi

PathFindExtensionA
PathIsDirectoryA
PathAddBackslashA

msvcp71

?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

msvcr71

_except_handler3
memset
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
_purecall
strlen
??_V@YAXPAX@Z
memcpy
memmove
??0exception@@QAE@ABV0@@Z
free
malloc
_CxxThrowException
__CppXcptFilter
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
__security_error_handler
_resetstkoflw
??1type_info@@UAE@XZ
_callnewh
sprintf
_mbslen
_mbsicmp
fopen
fprintf
wcsncpy
fclose
vsprintf
_vscprintf
strcpy
rand
srand
time
swprintf
_mbsnbcpy
_mbscmp
_mbsrchr
strcat
realloc
memcmp

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6710c264ad2124a056e44d05a439ccd2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2Certificate

Extended Key Usages

Key Usages

c0:d2:c3:52:03:10:57:87:a9:eb:b6:43:95:86:ee:4f:91:4a:e8:c3Signer

Signature Validations

Verification

15/12/2022, 14:03 Valid: false

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 12KB - Virtual size: 11KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

4b:da:43:8e:69:27:c9:46:a4:9a:dd:3e:6a:c9:da:d2
Certificate

c0:d2:c3:52:03:10:57:87:a9:eb:b6:43:95:86:ee:4f:91:4a:e8:c3
Signer

15/12/2022, 14:03
Valid: false

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 12KB - Virtual size: 11KB