Activation[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Activation.dll
Size

2.5MB
MD5

6e49db5bdf1565763e39e79215ff4100
SHA1

343a79fb6952f0f8c235f6080a824d920f5f8581
SHA256

afa0db94172c69110527cc9609e2e42d8bee2d40647c0aba8ed0e1f2beb2be80
SHA512

128597d3be56f6aae643934dd34ef9805d900330caddc099b7c39301e6abacee8e505811bdc04283085f4813e4d66727c6c379aea4503270466de9b84b5e03ef
SSDEEP

24576:Yp4qNoaP/kLmVFu1zJzx21Tb/pPwbbNT1kNzt4WYW4P:JqNogsLmVFu1zJzx2/pObNhkNRp4P

Score

1^/10

Malware Config

Signatures

Files

Activation.dll
.dll windows x86

b4f5d2e5eca3cbe7e9c64f61cf501445

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:36:55:50:99:a7:9c:6c:cc:5a:ff:11:b7:ec:33:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/07/2021, 00:00

Not After

20/07/2022, 23:59

Subject

CN=Electronic Arts\, Inc.,OU=Origin Client,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c1c777774736f2d73736c2d61646d696e735f656168714065612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

99:9c:00:a1:10:5c:f9:d5:08:9b:90:d8:f7:02:90:53:98:e6:c4:26
Signer

Actual PE Digest

99:9c:00:a1:10:5c:f9:d5:08:9b:90:d8:f7:02:90:53:98:e6:c4:26

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Electronic Arts\, Inc.,OU=Origin Client,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c1c777774736f2d73736c2d61646d696e735f656168714065612e636f6d

20/07/2021, 13:13
Valid: true

Chain 1

CN=Electronic Arts\, Inc.,OU=Origin Client,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c1c777774736f2d73736c2d61646d696e735f656168714065612e636f6d

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetTextColor
SetBkMode
GetStockObject

user32

EndDialog
GetDlgItem
ShowWindow
GetProcessWindowStation
GetUserObjectInformationW
LoadStringW
MoveWindow
MessageBoxA
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
MessageBoxW
BeginPaint
EndPaint
PostMessageW
EnumWindows
GetWindowThreadProcessId
DialogBoxParamW

crypt32

CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CryptQueryObject

shlwapi

PathFileExistsA
PathAppendW
PathIsDirectoryW
ord12

wintrust

WinVerifyTrust

msvcp140

_Thrd_start
_Xtime_get_ticks
_Thrd_join
_Thrd_id
_Mtx_init
_Mtx_destroy
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_current_owns
_Mtx_lock
?_Xout_of_range@std@@YAXPBD@Z
_Thrd_sleep
?_Xbad_function_call@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_signal
_Mtx_unlock
?_Xlength_error@std@@YAXPBD@Z
_Cnd_timedwait
_Cnd_wait
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Cnd_destroy
_Cnd_init

gdiplus

GdiplusStartup
GdiplusShutdown
GdipFree
GdipDisposeImage
GdipLoadImageFromStream
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneImage
GdipAlloc

kernel32

GlobalMemoryStatus
FlushConsoleInputBuffer
GetFileType
GetStdHandle
OutputDebugStringW
InitializeSListHead
DisableThreadLibraryCalls
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
TerminateThread
CreateEventW
SetEvent
GetComputerNameW
GetLocaleInfoW
GetProcessId
CreateThread
SetLastError
GetModuleHandleW
CloseHandle
TerminateProcess
CreateProcessW
GetModuleHandleExW
GetLastError
VirtualProtect
GetProcAddress
LoadLibraryA
LoadResource
LockResource
SizeofResource
FindResourceW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetSystemDirectoryW
GetModuleFileNameW
LocalAlloc
Sleep
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentVariableA
GetEnvironmentVariableW
SetEnvironmentVariableA
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
ReleaseMutex
WaitForSingleObjectEx
CreateMutexA
GetCurrentProcess
GetCurrentThread
SetThreadPriority
GetThreadPriority
SetPriorityClass
GetPriorityClass
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryW
IsDebuggerPresent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetCurrentThreadId
ResumeThread
TlsAlloc
TlsFree
GetTickCount
GetModuleHandleA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
GetFileAttributesW
SetFileAttributesW
LocalFree
WriteFile

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear

vcruntime140

strstr
strchr
memcmp
__std_type_info_destroy_list
__std_exception_copy
_except_handler4_common
wcsstr
wcschr
__std_exception_destroy
__std_terminate
_CxxThrowException
memset
memmove
memcpy
memchr
__CxxFrameHandler3
_purecall

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_crt_atexit
_configure_narrow_argv
_execute_onexit_table
_seh_filter_dll
_initterm
_initterm_e
_invalid_parameter_noinfo
exit
terminate
_errno
_exit
raise
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
signal
_cexit

api-ms-win-crt-string-l1-1-0

strncmp
isupper
strcat
iswalnum
isxdigit
wcscat_s
strncpy
isdigit
wcscpy_s
isspace
strcmp
tolower
strcpy
strlen
_strnicmp

api-ms-win-crt-convert-l1-1-0

_ecvt
_strtoui64
strtoul
_wtoi64
atoi
_fcvt

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
ferror
fwrite
_fileno
fflush
fputs
fclose
freopen_s
_wfopen
fread
fseek
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vswprintf
__stdio_common_vfprintf
__stdio_common_vswscanf
__stdio_common_vswprintf_s
_setmode
_wfsopen
fgets
fopen
__stdio_common_vsprintf_s
feof
fgetpos

api-ms-win-crt-environment-l1-1-0

_wgetcwd
getenv

api-ms-win-crt-time-l1-1-0

_mktime64
_gmtime64
_gmtime64_s
_localtime64_s
_time64

api-ms-win-crt-math-l1-1-0

_except1

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32
_wchdir

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource
AllocateAndInitializeSid
FreeSid
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHCreateDirectoryExW

winhttp

WinHttpSendRequest
WinHttpSetCredentials
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpReadData
WinHttpSetOption
WinHttpQueryHeaders
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpConnect
WinHttpOpenRequest

api-ms-win-crt-utility-l1-1-0

_lrotl
_lrotr
qsort

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 814KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4f5d2e5eca3cbe7e9c64f61cf501445

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:36:55:50:99:a7:9c:6c:cc:5a:ff:11:b7:ec:33:e8Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

99:9c:00:a1:10:5c:f9:d5:08:9b:90:d8:f7:02:90:53:98:e6:c4:26Signer

Signature Validations

Verification

20/07/2021, 13:13 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

crypt32

shlwapi

wintrust

msvcp140

gdiplus

kernel32

ole32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

shell32

winhttp

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 814KB - Virtual size: 814KB

.rdata Size: 212KB - Virtual size: 211KB

.data Size: 28KB - Virtual size: 103KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 33KB - Virtual size: 32KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:36:55:50:99:a7:9c:6c:cc:5a:ff:11:b7:ec:33:e8
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

99:9c:00:a1:10:5c:f9:d5:08:9b:90:d8:f7:02:90:53:98:e6:c4:26
Signer

20/07/2021, 13:13
Valid: true

.text
Size: 814KB - Virtual size: 814KB

.rdata
Size: 212KB - Virtual size: 211KB

.data
Size: 28KB - Virtual size: 103KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 33KB - Virtual size: 32KB