e5tpinst[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

e5tpinst.dll
Size

149KB
MD5

5c0746ddbbc8c1b464776df46c179227
SHA1

80e7c3ba0e5202149dbae2663f718724ba3e44ea
SHA256

90cc034b80e15a4dcd021fbea1fc66558a4a13718d2ae6d784d268dfeccee0fa
SHA512

ff7f70e0899a073d5229b1983a0371f59e4e15eec4337508701d29520e44e7cb1614e7ea536824de22b16be8ca94e9d3e3438012cbe8113a64fcc1f4e21ab723
SSDEEP

3072:g09YB6FL+8iPDXSFEiAoUx1FAfHFv8ypGUpBH96heByDuH7U+ulbzXyf:5l5+7SDIcV8yIUr6hAyqbUzlbryf

Score

1^/10

Malware Config

Signatures

Files

e5tpinst.dll
.zip

Password: S@ndb0x!2023@@
Device/HarddiskVolume2/Program Files (x86)/ProductivityBoss_e5/bar/1.bin/e5tpinst.dll
.dll regsvr32 windows x86

Password: S@ndb0x!2023@@

c5eeb166ddd1ce6c83f20c385bb1e45d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2015, 00:00

Not After

18/06/2018, 23:59

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:8a:70:49:15:0b:48:27:8d:0c:58:42:53:ba:af:f9:b5:7e:71:b9
Signer

Actual PE Digest

9d:8a:70:49:15:0b:48:27:8d:0c:58:42:53:ba:af:f9:b5:7e:71:b9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCrackUrlA

urlmon

RegisterBindStatusCallback

kernel32

lstrcatA
GetWindowsDirectoryA
SetLastError
SetFileAttributesA
FreeLibrary
LoadLibraryA
GetCommandLineA
LockResource
ReleaseMutex
WaitForMultipleObjects
SetEvent
OpenProcess
CreateMutexA
CreateEventA
CreateProcessA
DisableThreadLibraryCalls
ResetEvent
OpenMutexA
CreateDirectoryA
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
GetModuleHandleW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
MulDiv
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
ResumeThread
FlushFileBuffers
LocalFree
lstrcmpA
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetConsoleCP
GetShortPathNameA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
LoadLibraryW
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetLocaleInfoW
Sleep
HeapSize
HeapReAlloc
HeapDestroy
HeapCreate
GetStdHandle
ExitProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
CreateThread
ExitThread
WriteFile
CreateFileW
DeleteFileA
MoveFileA
CreateFileA
GetFileSize
ReadFile
CloseHandle
lstrcpynA
GetDriveTypeA
GetFileAttributesA
WaitForSingleObject
DecodePointer
EncodePointer
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
GetVersionExA
VerSetConditionMask
VerifyVersionInfoW
FindResourceA
GetLastError
LoadResource
SizeofResource
IsDBCSLeadByte
GetModuleFileNameA
lstrcpyA
LoadLibraryExA
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleMode
SetStdHandle
WriteConsoleW
SetFilePointer

user32

CharNextA
wsprintfA
GetKeyboardType
PostMessageA
ShowWindow
SetFocus
IsChild
GetFocus
GetParent
DestroyWindow
IsWindow
InvalidateRect
DefWindowProcA
PostThreadMessageA
DispatchMessageA
TranslateMessage
UnregisterClassA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
CallWindowProcA
GetWindowLongA
SetWindowLongA
BeginPaint
GetClientRect
EndPaint
GetDC
ReleaseDC
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetKeyState
CharNextW
PostQuitMessage
PeekMessageA
RegisterClassExA
CreateWindowExA
GetMessageA

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegQueryValueExA
RegFlushKey
RegQueryInfoKeyA
RegOpenKeyExA

ole32

OleRegEnumVerbs
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
OleRegGetMiscStatus
CreateOleAdviseHolder
CoUninitialize
CoCreateGuid
CoInitialize
CreateBindCtx
OleRegGetUserType
CoTaskMemAlloc

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

oleaut32

VariantChangeType
VarUI4FromStr
SysFreeString
LoadRegTypeLi
UnRegisterTypeLi
LoadTypeLi
RegisterTypeLi
SysAllocString
OleCreatePropertyFrame
SysStringLen
VariantInit
VariantClear

shlwapi

PathFileExistsA

gdi32

CreateDCA
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateRectRgnIndirect
SetTextAlign
TextOutA

rpcrt4

UuidFromStringW
UuidFromStringA

crypt32

CertGetNameStringW
CryptDecodeObject
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EntryPoint

Sections

.text
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TRDPRT_I
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: S@ndb0x!2023@@

Password: S@ndb0x!2023@@

c5eeb166ddd1ce6c83f20c385bb1e45d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

9d:8a:70:49:15:0b:48:27:8d:0c:58:42:53:ba:af:f9:b5:7e:71:b9Signer

Headers

DLL Characteristics

File Characteristics

Imports

wininet

urlmon

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

rpcrt4

crypt32

wintrust

Exports

Exports

Sections

.text Size: 187KB - Virtual size: 186KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 9KB - Virtual size: 18KB

TRDPRT_I Size: 83KB - Virtual size: 82KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

9d:8a:70:49:15:0b:48:27:8d:0c:58:42:53:ba:af:f9:b5:7e:71:b9
Signer

.text
Size: 187KB - Virtual size: 186KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 9KB - Virtual size: 18KB

TRDPRT_I
Size: 83KB - Virtual size: 82KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB