easy_Benign_ff941f798da2f101dc16cddfc2d407d9e762f36e915c1aac5a3adffa9c20cd4d[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

easy_Benign_ff941f798da2f101dc16cddfc2d407d9e762f36e915c1aac5a3adffa9c20cd4d.dll
Size

20KB
MD5

5a88f020ff83e371624b4340196245cc
SHA1

847995be381d6d39dee652a520b7bf2c9f08cfb5
SHA256

ff941f798da2f101dc16cddfc2d407d9e762f36e915c1aac5a3adffa9c20cd4d
SHA512

cdf4ac18949c236e996bb9e2d2c73b0ce70b553065c28afc0ab529d07717db1ecb36732604073967962dc3aa303550f92a206cce1c625df99c476d8edd5f1f98
SSDEEP

192:uHY9+R5zNL7QWncsGQfWJ6WBNVxVyDBQABJJqtaVAGqnaj/Gzjus:8rz9UWnTtWJ6WjVyDBRJJLlbGzjus

Score

1^/10

Malware Config

Signatures

Files

easy_Benign_ff941f798da2f101dc16cddfc2d407d9e762f36e915c1aac5a3adffa9c20cd4d.dll
.dll windows x64

c22b977be4bf67b1a723dd49bcc47668

Code Sign

33:00:00:02:29:e8:93:3c:c4:14:fa:f5:7c:00:00:00:00:02:29
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2019, 19:21

Not After

27/03/2020, 19:21

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:1c:0f:97:48:1e:60:e0:79:43:38:6f:06:c4:d3:81:22:b1:f3:bb:60:1e:b8:f0:8d:0b:e0:fd:8d:20:a9:bf
Signer

Actual PE Digest

b5:1c:0f:97:48:1e:60:e0:79:43:38:6f:06:c4:d3:81:22:b1:f3:bb:60:1e:b8:f0:8d:0b:e0:fd:8d:20:a9:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

__C_specific_handler
RtlWow64GetCpuAreaInfo
RtlWow64GetCurrentCpuArea
RtlpWow64SetContextOnAmd64
NtQueryInformationProcess
NtSetInformationThread
RtlpWow64GetContextOnAmd64
NtProtectVirtualMemory
NtQueryInformationThread
RtlpWow64CtxFromAmd64
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter

wow64

Wow64PassExceptionToGuest
Wow64IsStackExtentsCheckEnforced
Wow64SystemServiceEx

Exports

Exports

BTCpuGetBopCode
BTCpuGetContext
BTCpuProcessInit
BTCpuResetToConsistentState
BTCpuSetContext
BTCpuSimulate
BTCpuTurboThunkControl
TurboDispatchJumpAddressEnd
TurboDispatchJumpAddressStart

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

WOW64SVC
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

W64SVC
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c22b977be4bf67b1a723dd49bcc47668

Code Sign

33:00:00:02:29:e8:93:3c:c4:14:fa:f5:7c:00:00:00:00:02:29Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b5:1c:0f:97:48:1e:60:e0:79:43:38:6f:06:c4:d3:81:22:b1:f3:bb:60:1e:b8:f0:8d:0b:e0:fd:8d:20:a9:bfSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

wow64

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

WOW64SVC Size: 512B - Virtual size: 45B

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 276B

W64SVC Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 512B - Virtual size: 120B

33:00:00:02:29:e8:93:3c:c4:14:fa:f5:7c:00:00:00:00:02:29
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b5:1c:0f:97:48:1e:60:e0:79:43:38:6f:06:c4:d3:81:22:b1:f3:bb:60:1e:b8:f0:8d:0b:e0:fd:8d:20:a9:bf
Signer

.text
Size: 4KB - Virtual size: 4KB

WOW64SVC
Size: 512B - Virtual size: 45B

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 276B

W64SVC
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 512B - Virtual size: 120B