orig_socialclub[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

orig_socialclub.dll
Size

1.5MB
MD5

0fe478ed14cd81342dc54022c0e5bdc2
SHA1

dc2db6a2ba0900d5139d3351821396871f31c2a2
SHA256

b0d37c9cc7b5d47d0d7122c201060422b5b265bd30339f9d56b3e430b5f28372
SHA512

2221fcc8a6644d78feba5d8a000863ab92d226fdc5d48fc4598cbb02733425311aab0f74a6d2d1997ec00a751d7a85b13c4d5f4515f4c84ddb4a19c6d71350b2
SSDEEP

24576:bK2d7tQWwVHlheuzibAzbJdBK2vRzf92HxArS2P4qvlzMgaET7w+ofEJ:sH5zibAzbJdBK2vRFr4qlzvzTs9fEJ

Score

1^/10

Malware Config

Signatures

Files

orig_socialclub.dll
.dll windows:5 windows x86 arch:x86

90d36b01527a3fb6f0874bae2f8de4bf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

09/03/2017, 22:04

Not After

20/03/2020, 22:34

Subject

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95
Signer

Actual PE Digest

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
UnmapViewOfFile
CreateFileMappingW
InterlockedExchangeAdd
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ConnectNamedPipe
CreateNamedPipeW
CancelIo
RegisterWaitForSingleObject
WaitForMultipleObjects
GetCurrentThreadId
GetVersionExW
GetCurrentDirectoryW
GetFileAttributesExW
GetComputerNameW
GetVolumeInformationA
GetEnvironmentVariableA
WideCharToMultiByte
GetModuleHandleExW
GetModuleFileNameW
CopyFileW
LocalFileTimeToFileTime
SystemTimeToFileTime
MapViewOfFile
SetEnvironmentVariableA
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
WriteConsoleW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileType
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
FlushFileBuffers
AreFileApisANSI
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
Sleep
MultiByteToWideChar
RtlCaptureStackBackTrace
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
GetProcessAffinityMask
GetCurrentProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateThread
GetCurrentThread
SetThreadPriority
SetThreadPriorityBoost
GetLastError
ResumeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CloseHandle
GetLocalTime
CreateEventA
CreateSemaphoreA
GetModuleHandleA
OutputDebugStringA
CreateDirectoryA
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
TerminateProcess
WriteFile
ReadFile
SetEndOfFile
SetFilePointerEx
FindClose
SetFileTime
CreateDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
LocalFree
InitializeCriticalSection
SetLastError
SetFilePointer
GetTickCount
CreateMutexW
CreateProcessW
InterlockedExchange
InterlockedCompareExchange
IsDebuggerPresent
RaiseException
CreateEventW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetStringTypeW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
HeapReAlloc
HeapSize
GetConsoleCP
GetConsoleMode
GetCPInfo
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
UnregisterWaitEx

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExA
RegSetValueExA
ConvertSidToStringSidW

shell32

ShellExecuteA
SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderPathA

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

ws2_32

ioctlsocket
accept
connect
getpeername
getsockname
freeaddrinfo
getaddrinfo
shutdown
htons
inet_addr
listen
recv
closesocket
bind
sendto
select
recvfrom
getsockopt
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
send
setsockopt
socket
gethostbyname

rpcrt4

UuidCreateSequential

xinput1_3

ord2

dinput8

DirectInput8Create

user32

PeekMessageW
DispatchMessageW
TranslateMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
CallMsgFilterW
GetQueueStatus
PostMessageW
WaitMessage
MsgWaitForMultipleObjectsEx
SetTimer
DefWindowProcW
MessageBoxA
DestroyWindow
PostQuitMessage
UpdateWindow
GetClientRect
GetCursorInfo
MessageBoxW
wsprintfW
SetWindowLongW
CallWindowProcW
ShowCursor
SetCursor
LoadCursorW
SendMessageW
GetAsyncKeyState
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
SetCursorPos
GetCursorPos
ClientToScreen
ScreenToClient
PtInRect
GetParent
KillTimer
SetWindowPos

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90d36b01527a3fb6f0874bae2f8de4bf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3eCertificate

Extended Key Usages

Key Usages

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

dbghelp

wininet

version

winmm

ws2_32

rpcrt4

xinput1_3

dinput8

user32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 290KB - Virtual size: 289KB

.data Size: 49KB - Virtual size: 2.9MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 112KB - Virtual size: 112KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 290KB - Virtual size: 289KB

.data
Size: 49KB - Virtual size: 2.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 112KB - Virtual size: 112KB