libfreshclam[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libfreshclam.dll
Size

693KB
MD5

a43b3a78411698c16bc3a88ec38aa595
SHA1

a974a6dbc6052d42a7f1dc4c4526da9333241405
SHA256

5beebbe4ce0f5824cc2fddfeb04fdbc35fc929d0e309061a1724ebcf93d66123
SHA512

2aeac7e910d22ca6987c26545dfad98e4c3eded3d0ffbde20f9c27ba8215f2b21d9e1f10ce5a68dcdd50c6fa30d59aacd72416c4e9a80e8dfae4c7d56c26d5df
SSDEEP

12288:8+0RLtDLymzJ2U8rovUHyVHHyxbqQ5Ug0znKf9dt/7NfH1y:SRpZ2U8rocSVHHyxGQ5UhznKldJVH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libfreshclam.dll

Files

libfreshclam.dll
.dll windows:6 windows x64 arch:x64

7fd6a227a481ce788d4dfa9f2a7164af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libcurl

curl_easy_perform
curl_easy_init
curl_easy_strerror
curl_easy_cleanup
curl_slist_free_all
curl_slist_append
curl_global_cleanup
curl_easy_getinfo
curl_easy_setopt
curl_global_init

libssl-1_1-x64

SSL_CTX_get_cert_store

libcrypto-1_1-x64

d2i_X509
ERR_error_string
ERR_get_error
X509_NAME_print_ex
X509_cmp
RAND_bytes
X509_free
X509_dup
X509_STORE_add_cert
BIO_s_mem
BIO_ctrl
X509_get_subject_name
BIO_new
BIO_free

libclamav

cl_cvdunpack
cli_dbgmsg_no_inline
cli_infomsg_simple
cli_warnmsg
cli_errmsg
cli_versig2
cli_ctime
cli_strerror
cli_filecopy
cli_gentemp
cli_rmdirs
cli_isnumber
cli_strbcasestr
cl_retflevel
cl_cvdfree
cl_debug
cl_engine_new
cl_engine_free
cl_engine_set_clcb_stats_submit
cl_load
cl_strerror
cli_hashset_destroy
cli_bytecode_prepare2
cli_strtok
cli_dbgmsg
cli_malloc
cli_strdup
cl_cvdhead
cl_cvdparse
cl_cvdverify
cli_get_debug_flag

pthreadvc3

pthread_mutex_unlock
pthread_win32_process_attach_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
pthread_win32_process_detach_np
pthread_mutex_lock

dnsapi

DnsFree
DnsQuery_A

wsock32

WSAStartup
ntohs
getservbyname
WSACleanup

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateContext
CertGetNameStringA
CertOpenSystemStoreA

kernel32

GetFileAttributesExW
GetFileAttributesA
DeleteFileA
CreateFileA
WriteConsoleW
GetConsoleMode
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
GetFullPathNameW
SetFileAttributesA
FormatMessageW
GetModuleHandleW
GetFinalPathNameByHandleW
SetUnhandledExceptionFilter
DeleteFileW
FindFirstFileW
DeviceIoControl
GetFileInformationByHandle
CreateFileW
FindNextFileW
GetModuleHandleA
LoadLibraryA
WaitForSingleObjectEx
AcquireSRWLockShared
HeapReAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
HeapFree
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
TerminateProcess
WaitForSingleObject
GetCurrentProcessId
GetStdHandle
SetFilePointerEx
GetEnvironmentVariableW
GetCurrentDirectoryW
SetLastError
RtlLookupFunctionEntry
GetProcAddress
RtlCaptureContext
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
MoveFileExW
CreateMutexA
Sleep
GetLastError
MoveFileA
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
FindClose
ReleaseSRWLockShared
GetCurrentThread
GetCurrentProcess

vcruntime140

memcpy
memcmp
_CxxThrowException
memset
memmove
wcsrchr
wcsstr
strrchr
strchr
__C_specific_handler
__std_type_info_destroy_list
strstr
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strncmp
strncpy
strcmp
_strnicmp
isprint
_strdup
strnlen
wcsncmp
wcsncat
wcsncpy

api-ms-win-crt-stdio-l1-1-0

_close
_read
_write
_getcwd
fgets
fopen
fclose
_lseeki64
_wopen
_lseek
fflush
_get_osfhandle
_open
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
calloc

api-ms-win-crt-convert-l1-1-0

wcstombs
atoi

api-ms-win-crt-time-l1-1-0

strftime
_time64
_localtime64_s
_localtime64

api-ms-win-crt-runtime-l1-1-0

strerror
_execute_onexit_table
_initterm_e
_seh_filter_dll
_cexit
_configure_narrow_argv
_errno
_initialize_narrow_environment
_initialize_onexit_table
_set_errno
_initterm

api-ms-win-crt-math-l1-1-0

trunc
round
fmod

api-ms-win-crt-filesystem-l1-1-0

_unlink
_chdir
_umask
rename
_mkdir
_fstat64i32

Exports

Exports

DllMain
__local_stdio_printf_options
dnsquery
fc_cleanup
fc_dns_query_update_info
fc_download_url_database
fc_download_url_databases
fc_initialize
fc_prune_database_directory
fc_set_fccb_download_complete
fc_strerror
fc_test_database
fc_update_database
fc_update_databases
fprintf
g_bCompressLocalDatabase
g_cb_download_complete
g_connectTimeout
g_databaseDirectory
g_freshclamDat
g_localIP
g_maxAttempts
g_proxyPassword
g_proxyPort
g_proxyServer
g_proxyUsername
g_requestTimeout
g_tempDirectory
g_userAgent
load_freshclam_dat
new_freshclam_dat
printf
save_freshclam_dat
snprintf
updatecustomdb
updatedb
version_string_compare

Sections

.text
Size: 443KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fd6a227a481ce788d4dfa9f2a7164af

Headers

DLL Characteristics

File Characteristics

Imports

libcurl

libssl-1_1-x64

libcrypto-1_1-x64

libclamav

pthreadvc3

dnsapi

wsock32

crypt32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 443KB - Virtual size: 442KB

.rdata Size: 213KB - Virtual size: 212KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 28KB - Virtual size: 27KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 443KB - Virtual size: 442KB

.rdata
Size: 213KB - Virtual size: 212KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 5KB