bzuid[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

bzuid.dll
Size

1.2MB
MD5

7ad4e70bd23811ed2222095c07f799d7
SHA1

acf9e5ba1a6079a25b3323f639c01bfbd6d8f997
SHA256

988b219fe77917451d0e5d30c45e81d2d9009ffad10b552db390664e038a11b6
SHA512

1ed47facd8a2f93fdd32cd9eb2cf2915f1feeb4f8911c23b1d9590a63733f9de10fb660bbf618f642238fcbe684d9db87180d8b472c812cefc44383a21329533
SSDEEP

24576:UT7OUTsDGhWkHBhA/hfCgcdyV8v/KEr0eHe6Pbj60L5BusQ4ShwklyDhJEMIIbxI:O1hc/CLr9L5BuxDCrEMIIbx9xoh

Score

1^/10

Malware Config

Signatures

Files

bzuid.dll
.dll windows x86

3440448aa7744d3be89021b06f2a7cff

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:f8:d0:88:37:78:68:0b:14:70:ec:e4:fc:66:07:41
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07-09-2022 00:00

Not After

07-09-2023 23:59

Subject

CN=BEDBROOK TECHNOLOGY LIMITED,O=BEDBROOK TECHNOLOGY LIMITED,L=Colorado Springs,ST=Colorado,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:bc:43:1a:ad:e6:ce:81:49:b3:ba:98:e8:26:d2:1f:72:83:7c:1d:02:e5:4c:c0:9c:8e:65:37:6b:75:d8:be
Signer

Actual PE Digest

0f:bc:43:1a:ad:e6:ce:81:49:b3:ba:98:e8:26:d2:1f:72:83:7c:1d:02:e5:4c:c0:9c:8e:65:37:6b:75:d8:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameW
GetCurrentProcessId
GetSystemDirectoryW
IsWow64Process
GetCurrentProcess
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
LocalAlloc
CreatePipe
GetStartupInfoA
CreateProcessA
LocalFree
GetExitCodeProcess
PeekNamedPipe
ReadFile
WaitForSingleObject
FindFirstFileW
FileTimeToSystemTime
FindNextFileW
FindClose
InitializeProcThreadAttributeList
GetProcessHeap
DeleteProcThreadAttributeList
DeleteCriticalSection
DecodePointer
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
DeleteFileW
CreateThread
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetEndOfFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
GetConsoleCP
WriteFile
FlushFileBuffers
GetStdHandle
CreateProcessW
ResumeThread
ExitThread
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
SetErrorMode
UpdateProcThreadAttribute
LoadLibraryA
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
SetStdHandle
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
FormatMessageA
UnmapViewOfFile
Sleep
GetSystemDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTickCount
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateSemaphoreA
SetLastError
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
VirtualProtect
FormatMessageW
WideCharToMultiByte
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetCurrentThreadId
MultiByteToWideChar
TryEnterCriticalSection
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetTempPathW
AreFileApisANSI
MoveFileExW
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter

user32

GetDC
GetSystemMetrics
ReleaseDC

gdi32

DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

CryptGenRandom
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetUserNameW
CryptReleaseContext

shell32

SHGetFolderPathA
SHGetFolderPathW

ole32

CreateStreamOnHGlobal
CoGetClassObject
CoInitialize

oleaut32

SysAllocStringByteLen
SysFreeString
SysAllocStringLen

shlwapi

StrStrIA

gdiplus

GdiplusShutdown
GdiplusStartup
GdipSaveImageToStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipFree
GdipCloneImage
GdipDisposeImage
GdipAlloc

iphlpapi

if_nametoindex
GetAdaptersAddresses

ws2_32

select
getpeername
WSASend
WSARecv
ioctlsocket
WSAGetLastError
WSASetLastError
shutdown
setsockopt
listen
getsockopt
bind
send
accept
inet_ntop
WSACleanup
WSAStartup
WSAGetOverlappedResult
WSAIoctl
freeaddrinfo
getaddrinfo
getprotobynumber
getservbyname
recv
socket
ntohs
htons
closesocket
connect
getsockname
htonl

version

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

Exports

Exports

GetBZUID
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 1007KB - Virtual size: 1007KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3440448aa7744d3be89021b06f2a7cff

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

02:f8:d0:88:37:78:68:0b:14:70:ec:e4:fc:66:07:41Certificate

Extended Key Usages

Key Usages

0f:bc:43:1a:ad:e6:ce:81:49:b3:ba:98:e8:26:d2:1f:72:83:7c:1d:02:e5:4c:c0:9c:8e:65:37:6b:75:d8:beSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

iphlpapi

ws2_32

version

Exports

Exports

Sections

.text Size: 1007KB - Virtual size: 1007KB

.rdata Size: 176KB - Virtual size: 175KB

.data Size: 14KB - Virtual size: 29KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 35KB - Virtual size: 35KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

02:f8:d0:88:37:78:68:0b:14:70:ec:e4:fc:66:07:41
Certificate

0f:bc:43:1a:ad:e6:ce:81:49:b3:ba:98:e8:26:d2:1f:72:83:7c:1d:02:e5:4c:c0:9c:8e:65:37:6b:75:d8:be
Signer

.text
Size: 1007KB - Virtual size: 1007KB

.rdata
Size: 176KB - Virtual size: 175KB

.data
Size: 14KB - Virtual size: 29KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 35KB - Virtual size: 35KB