2411b23bab7703e94897573f3758e1849fdc6f407ea1d1e5da20a4e07ecf3c09[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

2411b23bab7703e94897573f3758e1849fdc6f407ea1d1e5da20a4e07ecf3c09.dll
Size

473KB
MD5

3d051c701fbdf002650f8f90267ee16d
SHA1

e835e5d57c769cb86e9e61ff8e28d7bad1421cdb
SHA256

2411b23bab7703e94897573f3758e1849fdc6f407ea1d1e5da20a4e07ecf3c09
SHA512

4018efc79da22eb577a889b608c662ae5d59fc6c8dead939fd814675c08fdd0ac372aa132357451fe4231f592a13ad9b3dfca0f2a12ef9946601a277c18a7dde
SSDEEP

6144:nYGKcdvv6azsXOkDriqiN0DaSCrIB28UJ1F5FRpS0Xu0X:YGKKDADhi+Da3rIByJ13pRxX

Score

1^/10

Malware Config

Signatures

Files

2411b23bab7703e94897573f3758e1849fdc6f407ea1d1e5da20a4e07ecf3c09.dll
.dll regsvr32 windows x86

2f7d1706341a4c1a58fd983f48b245ef

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14-10-2019 00:00

Not After

18-10-2022 12:00

Subject

CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14-10-2019 00:00

Not After

18-10-2022 12:00

Subject

CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:97:12:2c:73:9a:00:3b:dd:e2:f5:7d:da:a3:e5:87:24:68:44:d2:7d:48:e3:24:03:0d:53:75:23:b4:50:0b
Signer

Actual PE Digest

29:97:12:2c:73:9a:00:3b:dd:e2:f5:7d:da:a3:e5:87:24:68:44:d2:7d:48:e3:24:03:0d:53:75:23:b4:50:0b

Digest Algorithm

sha256

PE Digest Matches

false

13:97:35:c3:74:3c:ad:b0:3d:53:21:3c:98:12:d6:58:38:03:6c:5d
Signer

Actual PE Digest

13:97:35:c3:74:3c:ad:b0:3d:53:21:3c:98:12:d6:58:38:03:6c:5d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AreFileApisANSI
GetNumaHighestNodeNumber
SetThreadAffinityMask
ReadFile
OpenEventA
SizeofResource
TryEnterCriticalSection
GetLogicalDrives
GetOEMCP
CompareFileTime
GlobalHandle
GetFileSizeEx
CreateTimerQueueTimer
FindFirstFileExW
SetWaitableTimer
TlsSetValue
FindFirstVolumeW
GetSystemDefaultLCID
VirtualProtect
VerifyVersionInfoA
HeapFree
SetLastError
EnterCriticalSection
VirtualFree
GetCommandLineW
GetCurrentProcess
GetStdHandle
ReleaseSemaphore
WriteFile
RegisterWaitForSingleObject
GetModuleHandleExW
UnregisterWait
DeviceIoControl
LCMapStringA
VirtualAlloc
TerminateProcess
GetProcessAffinityMask
LoadLibraryExA
SetFileTime
WaitForMultipleObjects
GetConsoleCP
SignalObjectAndWait
SetThreadPriority
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
ExpandEnvironmentStringsA
SetErrorMode
SetFilePointer
GetCompressedFileSizeW
SetEndOfFile
PeekNamedPipe
WaitForMultipleObjectsEx
FindClose
GetVolumePathNameW
WaitForSingleObject
FreeLibraryAndExitThread
GetCurrentThreadId
lstrcmpA
ResumeThread
UnmapViewOfFile
DuplicateHandle
ExitThread
GetModuleHandleA
GetLocaleInfoA
GetACP
HeapSize
GetVersion
GetCommandLineA
GetVolumeNameForVolumeMountPointW
GetExitCodeThread
Sleep
GetConsoleMode
GetTimeZoneInformation
LocalFileTimeToFileTime
GetLastError
ChangeTimerQueueTimer
GetFileAttributesA
GetStringTypeExA
CreateFileA
GetUserDefaultLCID
SetEvent
GetLogicalProcessorInformation
FileTimeToSystemTime
GetCurrentThread
InterlockedFlushSList
GetSystemDirectoryA
TerminateThread
LoadLibraryA
WaitForSingleObjectEx
TlsAlloc
GetVersionExA
LockResource
QueryPerformanceFrequency
GetThreadPriority
GlobalAlloc
GlobalFree
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
CreateThread
ResetEvent
GetWindowsDirectoryA
LoadResource
HeapAlloc
FileTimeToLocalFileTime
QueueUserAPC
GetLocalTime
SetStdHandle
CreateWaitableTimerA
SwitchToThread
HeapDestroy
GlobalLock
SetFilePointerEx
UnregisterWaitEx
LocalFree
MoveFileExW
IsProcessorFeaturePresent
GetFileSize
DeleteCriticalSection
ExitProcess
VerSetConditionMask
FindVolumeClose
SetEnvironmentVariableA
GetCurrentProcessId
UnhandledExceptionFilter
GetProcessHeap
SystemTimeToFileTime
IsValidLocale
FreeLibrary
FlushInstructionCache
GetVolumePathNamesForVolumeNameW
SleepEx
VerifyVersionInfoW
TlsGetValue
GetThreadTimes
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
GetFileType
DeleteTimerQueueTimer
TlsFree
CreateDirectoryA
GetSystemTime
GlobalMemoryStatus
FormatMessageA
BackupRead
CreateSemaphoreA
InterlockedPushEntrySList
DosDateTimeToFileTime
CreateEventA
MapViewOfFile
FindNextVolumeW
BackupSeek
QueryPerformanceCounter
InitializeSListHead
GetTickCount
GlobalUnlock
MulDiv
VirtualQuery
IsWow64Process
GetFileTime
InterlockedPopEntrySList
GlobalReAlloc
IsDebuggerPresent
VirtualQueryEx
QueryDepthSList
CreateTimerQueue
SetUnhandledExceptionFilter
FlushFileBuffers
FileTimeToDosDateTime

user32

EnableMenuItem
SetScrollPos
GetSysColorBrush
GetDesktopWindow
PostQuitMessage
CheckDlgButton
KillTimer
ShowCaret
LookupIconIdFromDirectoryEx
DrawIconEx
SetRect
GetMenuInfo
GetDlgItem
GetClientRect
CheckMenuItem
RemoveMenu
GetComboBoxInfo
MapDialogRect
SetScrollRange
FlashWindowEx
SetRectEmpty
SetCursor
SetClipboardData
GetWindowDC
SetCapture
SetParent
DestroyCaret
DragDetect
SetWindowContextHelpId
TranslateMessage
GetUpdateRect
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
DestroyMenu
EnumWindows
UnhookWindowsHookEx
IsDlgButtonChecked
MoveWindow
IsWindowEnabled
GetSysColor
DrawFocusRect
FrameRect
TrackMouseEvent
SetMenuInfo
SetWindowPlacement
MapWindowPoints
CreateCaret
IsChild
ExitWindowsEx
EmptyClipboard
DestroyAcceleratorTable
CloseClipboard
ClientToScreen
GetDlgCtrlID
DrawEdge
IsMenu
DestroyIcon
RedrawWindow
SetTimer
GetCapture
OffsetRect
OpenClipboard
InvalidateRgn
IsWindow
ShowWindow
GetActiveWindow
GetSubMenu
SetCaretPos
TrackPopupMenu
DestroyCursor
GetWindowPlacement
WindowFromPoint
MsgWaitForMultipleObjects
GetScrollInfo
SetMenuItemBitmaps
CreatePopupMenu
MessageBeep
GetSystemMetrics
EndDialog
CallNextHookEx
ScreenToClient
DeleteMenu
GetIconInfo
FillRect
HideCaret
CopyIcon
LoadStringA
EnumChildWindows
GetMenuItemCount
MonitorFromWindow
CopyImage
SetWindowPos
IsWindowVisible
GetDC
InflateRect
DestroyWindow
GetFocus
GetMenu
GetMenuItemID
GetWindowRect
CreateIconFromResourceEx
GetWindow
CheckMenuRadioItem
MonitorFromPoint
GetMessagePos
GetKeyState
AdjustWindowRectEx
GetSystemMenu
CharLowerBuffA
GetWindowThreadProcessId
EndPaint
CharLowerA
GetParent
PtInRect
UpdateWindow
DrawFrameControl
ReleaseCapture
InvalidateRect
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
BeginPaint
CopyRect

oleaut32

VarBstrFromR8
VariantInit
LoadTypeLi
SysFreeString
SysAllocStringByteLen
SysAllocString
VarBstrCmp
DispCallFunc
SysStringLen
SysAllocStringLen
VariantChangeType
VariantClear
VarUI4FromStr

Exports

Exports

DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f7d1706341a4c1a58fd983f48b245ef

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66Certificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

29:97:12:2c:73:9a:00:3b:dd:e2:f5:7d:da:a3:e5:87:24:68:44:d2:7d:48:e3:24:03:0d:53:75:23:b4:50:0bSigner

13:97:35:c3:74:3c:ad:b0:3d:53:21:3c:98:12:d6:58:38:03:6c:5dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

oleaut32

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 366KB - Virtual size: 366KB

.reloc Size: 1KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

29:97:12:2c:73:9a:00:3b:dd:e2:f5:7d:da:a3:e5:87:24:68:44:d2:7d:48:e3:24:03:0d:53:75:23:b4:50:0b
Signer

13:97:35:c3:74:3c:ad:b0:3d:53:21:3c:98:12:d6:58:38:03:6c:5d
Signer

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 366KB - Virtual size: 366KB

.reloc
Size: 1KB - Virtual size: 1KB