Benign_ffdb80ed8dc5df2946e389595ca05c9bb43bae34806f00484bcd0ed9926b2d1b[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Benign_ffdb80ed8dc5df2946e389595ca05c9bb43bae34806f00484bcd0ed9926b2d1b.dll
Size

24KB
MD5

d774c43f3db875834bdfce9215c9a9c7
SHA1

9d53904bf4115a67ccb71838b68442caaa527bc0
SHA256

ffdb80ed8dc5df2946e389595ca05c9bb43bae34806f00484bcd0ed9926b2d1b
SHA512

cc5c1883e172de720d2b1706b99f5b70e1739f1b22fab3c5b5bff40bade4e01898ef7b6f6ae48980e01b43efb9de2e3034328dc35626ad8287ffd421fcdd397a
SSDEEP

384:FhCXGA1IonQq1km2lOET4eSInZGCxdFnBhgIUt73:F+Io/3ijZPFJW73

Score

1^/10

Malware Config

Signatures

Files

Benign_ffdb80ed8dc5df2946e389595ca05c9bb43bae34806f00484bcd0ed9926b2d1b.dll
.dll windows x86

6f5d2c740804f0e2e6b4ac1be8c62083

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2b:a4:cb:cc:b7:e2:c5:68:68:50:e0:1a:51:ed:ed:54
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/12/2019, 07:49

Not After

10/12/2020, 07:49

Subject

CN=Open Source Developer\, Matthias Koefferlein,O=Open Source Developer,L=Muenchen,C=DE,1.2.840.113549.1.9.1=#0c176d61747468696173406b6f65666665726c65696e2e6465

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:19:26:18:bf:73:0f:08:19:a7:a9:1e:90:21:bf:83:71:b2:72:0e
Signer

Actual PE Digest

09:19:26:18:bf:73:0f:08:19:a7:a9:1e:90:21:bf:83:71:b2:72:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby260

Sleep@4
rb_data_object_wrap
rb_define_class_under
rb_iv_set
rb_path2class
rb_require

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

_amsg_exit
_initterm
_iob
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf

libcrypto-1_1

MD5_Final
MD5_Init
MD5_Update

Exports

Exports

Init_md5

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 976B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f5d2c740804f0e2e6b4ac1be8c62083

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19Certificate

Extended Key Usages

Key Usages

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49Certificate

Extended Key Usages

Key Usages

2b:a4:cb:cc:b7:e2:c5:68:68:50:e0:1a:51:ed:ed:54Certificate

Extended Key Usages

Key Usages

09:19:26:18:bf:73:0f:08:19:a7:a9:1e:90:21:bf:83:71:b2:72:0eSigner

Headers

File Characteristics

Imports

msvcrt-ruby260

kernel32

msvcrt

libcrypto-1_1

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 48B

.rdata Size: 1KB - Virtual size: 1KB

/4 Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 976B

.edata Size: 512B - Virtual size: 66B

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1024B - Virtual size: 528B

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

2b:a4:cb:cc:b7:e2:c5:68:68:50:e0:1a:51:ed:ed:54
Certificate

09:19:26:18:bf:73:0f:08:19:a7:a9:1e:90:21:bf:83:71:b2:72:0e
Signer

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 48B

.rdata
Size: 1KB - Virtual size: 1KB

/4
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 976B

.edata
Size: 512B - Virtual size: 66B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 528B