RzChromaSDK64[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

RzChromaSDK64.dll
Size

261KB
MD5

b751fa85a8f4668f9fc89708207d2711
SHA1

4354e9f235174d258afd196efc96e85a19ccb72e
SHA256

1d88e5bb40b3f57c12541614be8623b8710c1f43b5757f68b9913ffb7ce737c1
SHA512

aed0bb4b2836e5989435c5cad0dfd3efdb0bd1ba0849e5d964824a703c60e6c9a947f60541bdbdea87dce52e2f8e1eda5c11fbbfce2c47246b0fc49a3b63b19f
SSDEEP

6144:iysCCqxP3QvmazKLVZwjtxpERzbQkRXHypNMeGkmGqJbrP:ieAXaxXHsfG/X

Score

1^/10

Malware Config

Signatures

Files

RzChromaSDK64.dll
.dll windows:6 windows x64 arch:x64

37f8f01ea41a561942b1d53df8fdd2b5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

10/11/2021, 00:00

Not After

09/11/2024, 23:59

Subject

CN=Hangil IT Co.\, Ltd,O=Hangil IT Co.\, Ltd,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:ed:e0:57:e3:d5:83:92:b2:d5:6a:f9:00:0d:fa:2b:c7:d0:65:98
Signer

Actual PE Digest

28:ed:e0:57:e3:d5:83:92:b2:d5:6a:f9:00:0d:fa:2b:c7:d0:65:98

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FindClose
GetModuleHandleA

ntdll

RtlVirtualUnwind

shell32

SHChangeNotifyRegister

advapi32

RegisterEventSourceW

user32

IsChild

Sections

Size: - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

37f8f01ea41a561942b1d53df8fdd2b5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

28:ed:e0:57:e3:d5:83:92:b2:d5:6a:f9:00:0d:fa:2b:c7:d0:65:98Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

shell32

advapi32

user32

Sections

Size: - Virtual size: 157KB

Size: - Virtual size: 49KB

Size: - Virtual size: 18KB

.pdata Size: 5KB - Virtual size: 5KB

Size: - Virtual size: 348B

Size: 103KB - Virtual size: 102KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

28:ed:e0:57:e3:d5:83:92:b2:d5:6a:f9:00:0d:fa:2b:c7:d0:65:98
Signer

.pdata
Size: 5KB - Virtual size: 5KB