dumped[.]bin | Triage

Resubmissions

17/05/2023, 12:11

230517-pcsxqsea2x 6

17/05/2023, 11:56

230517-n32rwseh56 6

Sharing

Copy URL Twitter E-mail

General

Target

dumped.bin
Size

473KB
MD5

c22ea7deff7267e520d28fd41adf717c
SHA1

3a368afbe9088852c068e0aedf53661fea21e3e0
SHA256

a383c00d4afce7703d884042f3556c71e8765f087ae1e398be4c9c4f163f4678
SHA512

7a3c9e70ab992250191a96b9d247902fb6d09b6c00677088a354a6caf11774479adec636e54e2f70c619a889ac81215710746d19a5c9c9877b5c79b3614aae71
SSDEEP

6144:zfDT6Bf++wbTPg37B+fEktaw9p/TEkMxp+aiCrIB28UJ1F5FRpS0XK0X:Ha5sTPgrB+fl/TEkMqaHrIByJ13pRFX

Score

1^/10

Malware Config

Signatures

Files

dumped.bin
.dll regsvr32 windows x86

Password: infected

2f7d1706341a4c1a58fd983f48b245ef

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14/10/2019, 00:00

Not After

18/10/2022, 12:00

Subject

CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14/10/2019, 00:00

Not After

18/10/2022, 12:00

Subject

CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:33:03:d9:31:66:c3:55:c9:d7:83:69:c1:b5:87:e4:f1:9a:75:ee:82:e1:1b:2b:01:c0:f5:f5:cc:77:fb:b6
Signer

Actual PE Digest

b8:33:03:d9:31:66:c3:55:c9:d7:83:69:c1:b5:87:e4:f1:9a:75:ee:82:e1:1b:2b:01:c0:f5:f5:cc:77:fb:b6

Digest Algorithm

sha256

PE Digest Matches

false

b5:e5:5a:70:51:b2:fe:9f:a6:14:38:2a:c9:c9:4d:20:79:31:43:59
Signer

Actual PE Digest

b5:e5:5a:70:51:b2:fe:9f:a6:14:38:2a:c9:c9:4d:20:79:31:43:59

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AreFileApisANSI
GetNumaHighestNodeNumber
SetThreadAffinityMask
ReadFile
OpenEventA
SizeofResource
TryEnterCriticalSection
GetLogicalDrives
GetOEMCP
CompareFileTime
GlobalHandle
GetFileSizeEx
CreateTimerQueueTimer
FindFirstFileExW
SetWaitableTimer
TlsSetValue
FindFirstVolumeW
GetSystemDefaultLCID
VirtualProtect
VerifyVersionInfoA
HeapFree
SetLastError
EnterCriticalSection
VirtualFree
GetCommandLineW
GetCurrentProcess
GetStdHandle
ReleaseSemaphore
WriteFile
RegisterWaitForSingleObject
GetModuleHandleExW
UnregisterWait
DeviceIoControl
LCMapStringA
VirtualAlloc
TerminateProcess
GetProcessAffinityMask
LoadLibraryExA
SetFileTime
WaitForMultipleObjects
GetConsoleCP
SignalObjectAndWait
SetThreadPriority
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
ExpandEnvironmentStringsA
SetErrorMode
SetFilePointer
GetCompressedFileSizeW
SetEndOfFile
PeekNamedPipe
WaitForMultipleObjectsEx
FindClose
GetVolumePathNameW
WaitForSingleObject
FreeLibraryAndExitThread
GetCurrentThreadId
lstrcmpA
ResumeThread
UnmapViewOfFile
DuplicateHandle
ExitThread
GetModuleHandleA
GetLocaleInfoA
GetACP
HeapSize
GetVersion
GetCommandLineA
GetVolumeNameForVolumeMountPointW
GetExitCodeThread
Sleep
GetConsoleMode
GetTimeZoneInformation
LocalFileTimeToFileTime
GetLastError
ChangeTimerQueueTimer
GetFileAttributesA
GetStringTypeExA
CreateFileA
GetUserDefaultLCID
SetEvent
GetLogicalProcessorInformation
FileTimeToSystemTime
GetCurrentThread
InterlockedFlushSList
GetSystemDirectoryA
TerminateThread
LoadLibraryA
WaitForSingleObjectEx
TlsAlloc
GetVersionExA
LockResource
QueryPerformanceFrequency
GetThreadPriority
GlobalAlloc
GlobalFree
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
CreateThread
ResetEvent
GetWindowsDirectoryA
LoadResource
HeapAlloc
FileTimeToLocalFileTime
QueueUserAPC
GetLocalTime
SetStdHandle
CreateWaitableTimerA
SwitchToThread
HeapDestroy
GlobalLock
SetFilePointerEx
UnregisterWaitEx
LocalFree
MoveFileExW
IsProcessorFeaturePresent
GetFileSize
DeleteCriticalSection
ExitProcess
VerSetConditionMask
FindVolumeClose
SetEnvironmentVariableA
GetCurrentProcessId
UnhandledExceptionFilter
GetProcessHeap
SystemTimeToFileTime
IsValidLocale
FreeLibrary
FlushInstructionCache
GetVolumePathNamesForVolumeNameW
SleepEx
VerifyVersionInfoW
TlsGetValue
GetThreadTimes
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
GetFileType
DeleteTimerQueueTimer
TlsFree
CreateDirectoryA
GetSystemTime
GlobalMemoryStatus
FormatMessageA
BackupRead
CreateSemaphoreA
InterlockedPushEntrySList
DosDateTimeToFileTime
CreateEventA
MapViewOfFile
FindNextVolumeW
BackupSeek
QueryPerformanceCounter
InitializeSListHead
GetTickCount
GlobalUnlock
MulDiv
VirtualQuery
IsWow64Process
GetFileTime
InterlockedPopEntrySList
GlobalReAlloc
IsDebuggerPresent
VirtualQueryEx
QueryDepthSList
CreateTimerQueue
SetUnhandledExceptionFilter
FlushFileBuffers
FileTimeToDosDateTime

user32

EnableMenuItem
SetScrollPos
GetSysColorBrush
GetDesktopWindow
PostQuitMessage
CheckDlgButton
KillTimer
ShowCaret
LookupIconIdFromDirectoryEx
DrawIconEx
SetRect
GetMenuInfo
GetDlgItem
GetClientRect
CheckMenuItem
RemoveMenu
GetComboBoxInfo
MapDialogRect
SetScrollRange
FlashWindowEx
SetRectEmpty
SetCursor
SetClipboardData
GetWindowDC
SetCapture
SetParent
DestroyCaret
DragDetect
SetWindowContextHelpId
TranslateMessage
GetUpdateRect
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
DestroyMenu
EnumWindows
UnhookWindowsHookEx
IsDlgButtonChecked
MoveWindow
IsWindowEnabled
GetSysColor
DrawFocusRect
FrameRect
TrackMouseEvent
SetMenuInfo
SetWindowPlacement
MapWindowPoints
CreateCaret
IsChild
ExitWindowsEx
EmptyClipboard
DestroyAcceleratorTable
CloseClipboard
ClientToScreen
GetDlgCtrlID
DrawEdge
IsMenu
DestroyIcon
RedrawWindow
SetTimer
GetCapture
OffsetRect
OpenClipboard
InvalidateRgn
IsWindow
ShowWindow
GetActiveWindow
GetSubMenu
SetCaretPos
TrackPopupMenu
DestroyCursor
GetWindowPlacement
WindowFromPoint
MsgWaitForMultipleObjects
GetScrollInfo
SetMenuItemBitmaps
CreatePopupMenu
MessageBeep
GetSystemMetrics
EndDialog
CallNextHookEx
ScreenToClient
DeleteMenu
GetIconInfo
FillRect
HideCaret
CopyIcon
LoadStringA
EnumChildWindows
GetMenuItemCount
MonitorFromWindow
CopyImage
SetWindowPos
IsWindowVisible
GetDC
InflateRect
DestroyWindow
GetFocus
GetMenu
GetMenuItemID
GetWindowRect
CreateIconFromResourceEx
GetWindow
CheckMenuRadioItem
MonitorFromPoint
GetMessagePos
GetKeyState
AdjustWindowRectEx
GetSystemMenu
CharLowerBuffA
GetWindowThreadProcessId
EndPaint
CharLowerA
GetParent
PtInRect
UpdateWindow
DrawFrameControl
ReleaseCapture
InvalidateRect
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
BeginPaint
CopyRect

oleaut32

VarBstrFromR8
VariantInit
LoadTypeLi
SysFreeString
SysAllocStringByteLen
SysAllocString
VarBstrCmp
DispCallFunc
SysStringLen
SysAllocStringLen
VariantChangeType
VariantClear
VarUI4FromStr

Exports

Exports

DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

2f7d1706341a4c1a58fd983f48b245ef

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66Certificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

b8:33:03:d9:31:66:c3:55:c9:d7:83:69:c1:b5:87:e4:f1:9a:75:ee:82:e1:1b:2b:01:c0:f5:f5:cc:77:fb:b6Signer

b5:e5:5a:70:51:b2:fe:9f:a6:14:38:2a:c9:c9:4d:20:79:31:43:59Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

oleaut32

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 365KB - Virtual size: 365KB

.reloc Size: 1KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

b8:33:03:d9:31:66:c3:55:c9:d7:83:69:c1:b5:87:e4:f1:9a:75:ee:82:e1:1b:2b:01:c0:f5:f5:cc:77:fb:b6
Signer

b5:e5:5a:70:51:b2:fe:9f:a6:14:38:2a:c9:c9:4d:20:79:31:43:59
Signer

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 365KB - Virtual size: 365KB

.reloc
Size: 1KB - Virtual size: 1KB