OnlineFix[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OnlineFix.dll
Size

4.1MB
MD5

74ac7d343db85ec5471bd17e7944e9e7
SHA1

2743b51f2ef34b12e859d282a9907da6d303f189
SHA256

b19c81de5633055730fe1918bd79033424942f6a80866d8ff563e2a3d4bbbc18
SHA512

f63cdbb666577e419848c3d77772bd1d8a8e4ebf27718315b83066403cec79d733abdba1c696e6a7a46a3c08bb90ed4bea72131127e228027e3023a5415461bb
SSDEEP

98304:UzZVvhaK/JIQnQ4ilU78HXBH57mx2Gc4S6rwXUx5Uw26q:UzZVkkQVba7wXR

Score

1^/10

Malware Config

Signatures

Files

OnlineFix.dll
.dll windows x86

4c5ee9927a68172358013137dc9cbfe1

Code Sign

3f:3e:1f:61:f6:ef:5c:6c:cd:4a:23:d6:9a:ca:97:3d:ce:16:2c:51
Certificate

Issuer

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Not Before

16/02/2021, 23:11

Not After

16/03/2021, 23:11

Subject

CN=OnlineFix,OU=OnlineFix,O=OnlineFix,L=OnlineFix,ST=OnlineFix,C=CA,1.2.840.113549.1.9.1=#0c166f6e6c696e65666978406f6e6c696e656669782e6d65

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e6
Certificate

Issuer

CN=Ascertia Root CA 2,O=Ascertia,C=GB

Not Before

21/04/2009, 12:15

Not After

14/04/2028, 23:59

Subject

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:19:33:23:1d:3e:40:4b:25:9f:cd:52:da:cf:20:87:d3:7e:fb:25:37:ba:11:98:ce:a1:a2:ee:e5:ea:86:80
Signer

Actual PE Digest

98:19:33:23:1d:3e:40:4b:25:9f:cd:52:da:cf:20:87:d3:7e:fb:25:37:ba:11:98:ce:a1:a2:ee:e5:ea:86:80

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OnlineFix,OU=OnlineFix,O=OnlineFix,L=OnlineFix,ST=OnlineFix,C=CA,1.2.840.113549.1.9.1=#0c166f6e6c696e65666978406f6e6c696e656669782e6d65

19/02/2021, 11:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

shell32

SHGetSpecialFolderPathA

ws2_32

ioctlsocket

wldap32

ord27

advapi32

RegisterEventSourceA

Exports

Exports

Breakpad_SteamMiniDumpInit
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
OnlineFix
ShellExecuteA
ShellExecuteW
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_LogOff
Steam_LogOn
Steam_ReleaseThreadLocalMemory
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write
hid_write_output_report

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.of0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.of1
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c5ee9927a68172358013137dc9cbfe1

Code Sign

3f:3e:1f:61:f6:ef:5c:6c:cd:4a:23:d6:9a:ca:97:3d:ce:16:2c:51Certificate

Extended Key Usages

Key Usages

e6Certificate

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

98:19:33:23:1d:3e:40:4b:25:9f:cd:52:da:cf:20:87:d3:7e:fb:25:37:ba:11:98:ce:a1:a2:ee:e5:ea:86:80Signer

Signature Validations

Verification

19/02/2021, 11:51 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ws2_32

wldap32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 340KB

.data Size: - Virtual size: 50KB

.of0 Size: - Virtual size: 1.7MB

.of1 Size: 4.1MB - Virtual size: 4.1MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 652B

3f:3e:1f:61:f6:ef:5c:6c:cd:4a:23:d6:9a:ca:97:3d:ce:16:2c:51
Certificate

e6
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

98:19:33:23:1d:3e:40:4b:25:9f:cd:52:da:cf:20:87:d3:7e:fb:25:37:ba:11:98:ce:a1:a2:ee:e5:ea:86:80
Signer

19/02/2021, 11:51
Valid: false

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 340KB

.data
Size: - Virtual size: 50KB

.of0
Size: - Virtual size: 1.7MB

.of1
Size: 4.1MB - Virtual size: 4.1MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 652B