0D6E44106D17BC6A160963422FE922D0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

0D6E44106D17BC6A160963422FE922D0.dll
Size

193KB
MD5

0d6e44106d17bc6a160963422fe922d0
SHA1

05d927c87d26e6c7511c981cd6d4863afdcabb7d
SHA256

2888446e99794e53fc74ad4d6531dbb6337aefd693a27f1b30d2aa06a3e7d7a5
SHA512

ad6f73c25cb2d9eefafd101f2724ea9a2ab2577c4bc5288b8740cd5a516fa0f18891bb1278130b592ed44b414df9889577bfbb76bd9f092bdf6e6f9b6d3d9164
SSDEEP

3072:yC6yLrQcXYAkb61O2FvyP890Z/CR93by7rNrRvP0me:y6QCYqv5mqXMt+p

Score

N/A

Malware Config

Signatures

Files

0D6E44106D17BC6A160963422FE922D0.dll
.dll regsvr32 windows x86

4333e266ac73fa199d5b1ceb8d0d5405

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:6d:f1:6d:9a:96:58:9f:6a:a7:1c:8b
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

02/03/2021, 16:38

Not After

02/03/2024, 16:38

Subject

SERIALNUMBER=01.09.2011,CN=Dipl.-Ing. Walter Kunter,O=Dipl.-Ing. Walter Kunter,STREET=Hartl 27/1,L=Übersbach,ST=Styria,C=AT,1.2.840.113549.1.9.1=#0c17737570706f7274406172676574686572617069652e6174,1.3.6.1.4.1.311.60.2.1.1=#131548617274626572672d467565727374656e66656c64,1.3.6.1.4.1.311.60.2.1.2=#1306537479726961,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:8a:a5:ce:56:b3:d5:1b:4c:94:76:53:8c:f5:aa:96:9f:a7:4a:f1:88:74:24:5b:2a:ab:66:22:73:f5:8a:04
Signer

Actual PE Digest

23:8a:a5:ce:56:b3:d5:1b:4c:94:76:53:8c:f5:aa:96:9f:a7:4a:f1:88:74:24:5b:2a:ab:66:22:73:f5:8a:04

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=01.09.2011,CN=Dipl.-Ing. Walter Kunter,O=Dipl.-Ing. Walter Kunter,STREET=Hartl 27/1,L=Übersbach,ST=Styria,C=AT,1.2.840.113549.1.9.1=#0c17737570706f7274406172676574686572617069652e6174,1.3.6.1.4.1.311.60.2.1.1=#131548617274626572672d467565727374656e66656c64,1.3.6.1.4.1.311.60.2.1.2=#1306537479726961,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

06/12/2022, 05:57
Valid: true

Chain 1

SERIALNUMBER=01.09.2011,CN=Dipl.-Ing. Walter Kunter,O=Dipl.-Ing. Walter Kunter,STREET=Hartl 27/1,L=Übersbach,ST=Styria,C=AT,1.2.840.113549.1.9.1=#0c17737570706f7274406172676574686572617069652e6174,1.3.6.1.4.1.311.60.2.1.1=#131548617274626572672d467565727374656e66656c64,1.3.6.1.4.1.311.60.2.1.2=#1306537479726961,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaI2Abs
__vbaStrCat
__vbaLsetFixstr
__vbaStrDate
__vbaSetSystemError
__vbaLenBstrB
__vbaHresultCheckObj
ord556
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord591
__vbaVarIndexLoadRefLock
__vbaLateMemSt
EVENT_SINK2_Release
__vbaExitProc
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaStrFixstr
__vbaBoolVar
__vbaRefVarAry
__vbaBoolVarNull
_CIsin
__vbaErase
ord525
__vbaVarZero
__vbaChkstk
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
ord560
__vbaI2I4
ord561
__vbaObjVar
DllFunctionCall
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaLateIdCallSt
__vbaObjIs
EVENT_SINK_QueryInterface
ord710
__vbaExceptHandler
ord712
ord605
_adj_fprem
_adj_fdivr_m64
__vbaLateIdStAd
__vbaI2Str
__vbaFailedFriend
ord716
__vbaFPException
ord319
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord537
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
EVENT_SINK2_AddRef
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
__vbaI4Var
ord103
ord104
ord610
ord105
__vbaInStrB
__vbaLateMemCall
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaVerifyVarObj
ord616
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaFpI4
__vbaLateMemCallLd
__vbaVarSetObjAddref
_CIatan
__vbaCastObj
__vbaStrMove
__vbaStrVarCopy
ord650
_allmul
__vbaLenVarB
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4333e266ac73fa199d5b1ceb8d0d5405

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

5c:6d:f1:6d:9a:96:58:9f:6a:a7:1c:8bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

23:8a:a5:ce:56:b3:d5:1b:4c:94:76:53:8c:f5:aa:96:9f:a7:4a:f1:88:74:24:5b:2a:ab:66:22:73:f5:8a:04Signer

Signature Validations

Verification

06/12/2022, 05:57 Valid: true

Chain 1

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 153KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 16KB - Virtual size: 12KB

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5c:6d:f1:6d:9a:96:58:9f:6a:a7:1c:8b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

23:8a:a5:ce:56:b3:d5:1b:4c:94:76:53:8c:f5:aa:96:9f:a7:4a:f1:88:74:24:5b:2a:ab:66:22:73:f5:8a:04
Signer

06/12/2022, 05:57
Valid: true

.text
Size: 156KB - Virtual size: 153KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 16KB - Virtual size: 12KB