xlive[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

xlive.dll
Size

13.6MB
MD5

8add582a45abb1b430d697281eded3b6
SHA1

121bec16a467e8f8d9ce5ccf48f9742da3eecf6b
SHA256

c03a3802c4ad3d902ce8fe34a5eccdf37f99902b3455177689a7871270094782
SHA512

21152ede569f56a8587d5b801f4b077a4b5c18ae95e2558ec57f22468b5a0de88727d89fd45219f969167e1a8fd7aa58752f20e72748cbc0541a68e26d47a916
SSDEEP

196608:Z/PlXEL7bzp74xwaoqNEIECNERY4lkko23ZUe7iw3QerO:fSZ7w1oq69m4lK23q2ir

Score

1^/10

Malware Config

Signatures

Files

xlive.dll
.dll windows:6 windows x86 arch:x86

e5bb48dd5097d2be929363ab0c6d8800

Code Sign

61:02:5a:c7:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft LIVE PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 20:04

Not After

22/01/2010, 20:14

Subject

CN=Microsoft LIVE Gaming for Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:ec:c8:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

23/10/2006, 23:54

Not After

24/10/2018, 00:04

Subject

CN=Microsoft LIVE PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fa:32:89:ed:a1:f0:77:44:97:42:f8:9e:7f:fa:a3:e7:ba:c7:67:b8
Signer

Actual PE Digest

fa:32:89:ed:a1:f0:77:44:97:42:f8:9e:7f:fa:a3:e7:ba:c7:67:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr90

_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
strchr
srand
_time64
vswprintf_s
_vscwprintf
memcpy_s
_stricmp
tolower
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
strtoul
isdigit
iswdigit
_wtol
_vswprintf_c_l
_CIsin
_CIcos
iswspace
_isnan
_finite
strcat_s
vsprintf_s
_setjmp3
longjmp
_wcslwr_s
modf
_unlock
wcstod
wcscat_s
towlower
swscanf_s
_snwprintf_s
_msize
_adjust_fdiv
strnlen
isalnum
wcsncat_s
_snprintf_s
_wcsupr_s
_strnicmp
strstr
_wtoi
sprintf_s
_vsnprintf_s
_vsnwprintf_s
rand_s
qsort
strtol
_snprintf
_CIpow
_CIasin
_CIlog10
_CIlog
calloc
cos
_CIexp
_strlwr_s
malloc
_snwscanf_s
strncpy_s
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_invoke_watson
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memmove_s
atol
__CppXcptFilter
strncpy
_except_handler4_common
swprintf_s
rand
_itow_s
wcsrchr
_wcsnicmp
strncmp
__dllonexit
_lock
_onexit
__clean_type_info_names_internal
_crt_debugger_hook
wcstol
wcschr
strcpy_s
toupper
towupper
_wcsicmp
_scprintf
_vsnprintf
wcstoul
_purecall
wcsnlen
wcsncpy_s
wcsncmp
wcsstr
realloc
free
floor
wcscpy_s
_vsnwprintf
memmove
memcpy
_CIsqrt
bsearch
memset
ceil

kernel32

GetLastError
SetLastError
ResetEvent
WideCharToMultiByte
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
QueryPerformanceFrequency
DeleteCriticalSection
WaitForSingleObject
SetEvent
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetCurrentProcessId
QueryPerformanceCounter
SetThreadPriority
CreateThread
CreateEventW
InitializeCriticalSection
InterlockedDecrement
GetTickCount
GlobalFree
GlobalAlloc
InterlockedExchange
Sleep
CreateFileW
FindClose
DeleteFileW
GetTempFileNameW
GetFullPathNameW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
GetFileAttributesW
SetFileAttributesW
OpenEventW
GetTempPathW
GetFileSize
GetDiskFreeSpaceExW
RemoveDirectoryW
InterlockedCompareExchange
CreateFileA
ReadFile
GetFileSizeEx
GetWindowsDirectoryW
GetSystemDirectoryW
GetModuleFileNameW
GetCurrentProcess
GetModuleHandleW
FreeLibrary
GlobalLock
MapViewOfFile
CreateFileMappingW
LoadLibraryExW
GetProcAddress
lstrcmpiW
LoadLibraryW
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
SetFilePointer
LocalFree
GetModuleHandleA
WriteFile
TlsFree
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceW
GetExitCodeThread
DuplicateHandle
GetCurrentThread
FindResourceA
GetVersionExA
CreateEventA
GetUserDefaultUILanguage
GetSystemDefaultLCID
LoadLibraryExA
IsDebuggerPresent
InterlockedExchangeAdd
TlsGetValue
PulseEvent
SleepEx
GetSystemTimeAsFileTime
GetModuleFileNameA
CreateProcessW
lstrlenW
WaitForSingleObjectEx
GetCurrentThreadId
QueueUserAPC
OpenThread
MultiByteToWideChar
FileTimeToSystemTime
CompareFileTime
LocalAlloc
LocalSize
VerifyVersionInfoA
VerSetConditionMask
GetGeoInfoA
GetUserGeoID
FindFirstFileA
FormatMessageW
ReleaseSemaphore
TlsSetValue
WaitForMultipleObjects
SetWaitableTimer
ResumeThread
CreateWaitableTimerA
CreateSemaphoreA
CompareStringA
SetFilePointerEx
GetFileAttributesExW
DeleteFileA
SetEndOfFile
CopyFileA
RaiseException
FileTimeToLocalFileTime
CreateProcessA
FindFirstFileExW
GetTimeFormatW
GetDateFormatW
SetFileTime
SystemTimeToFileTime
GetSystemTime
CreateDirectoryW
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
InitializeCriticalSectionAndSpinCount
GetThreadContext
SuspendThread
VirtualProtect
GetSystemInfo
GetVersion
GetTimeZoneInformation
lstrcmpW
lstrcmpiA
GetThreadPriority
MulDiv
GlobalUnlock
GetStringTypeW
GetLocaleInfoW
VerifyVersionInfoW
CancelIo
CopyFileW
TlsAlloc
lstrlenA
UnmapViewOfFile

psapi

GetModuleBaseNameW
EnumProcessModules
GetModuleInformation

user32

DefWindowProcW
SetCapture
ReleaseCapture
RegisterWindowMessageA
SetCursor
LoadCursorA
RegisterDeviceNotificationA
GetClientRect
GetCursorPos
ReleaseDC
GetDC
GetIconInfo
CallWindowProcA
GetWindowLongA
SetForegroundWindow
UnregisterDeviceNotification
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
PostMessageW
ShowWindow
GetDesktopWindow
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
GetSystemMetrics
GetWindowThreadProcessId
IsWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
SendInput
GetAsyncKeyState
IsChild
GetForegroundWindow
SendMessageA

advapi32

RegOpenKeyExW
GetTraceLoggerHandle
RegisterTraceGuidsA
UnregisterTraceGuids
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetUserNameA
GetTraceEnableLevel
OpenThreadToken
GetLengthSid
CopySid
GetTokenInformation
RegQueryValueExW
RegCloseKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
GetSidSubAuthorityCount
GetSidSubAuthority
CryptAcquireContextA
GetUserNameW
LookupAccountNameW
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
ConvertSidToStringSidW
OpenProcessToken
GetTraceEnableFlags

secur32

GetUserNameExA

shell32

ShellExecuteExW
SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW
ord165
ShellExecuteA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winhttp

WinHttpSetOption
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
WinHttpConnect
WinHttpWriteData
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitialize
CoCreateGuid

oleaut32

SysStringLen
SysAllocString
SysFreeString
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayGetElement
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayAccessData

imm32

ImmReleaseContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetContext
ImmGetVirtualKey
ImmNotifyIME

d3dx9_37

D3DXVec2Normalize
D3DXMatrixTranspose
D3DXPlaneFromPointNormal
D3DXMatrixRotationQuaternion
D3DXMatrixTranslation
D3DXMatrixMultiply
D3DXQuaternionSlerp
D3DXMatrixRotationZ
D3DXMatrixScaling
D3DXMatrixInverse
D3DXVec3TransformCoord
D3DXVec2TransformCoord

xinput1_3

ord7
ord8

winmm

waveInStart
waveInGetDevCapsW
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInClose
waveInReset
waveInMessage
mixerOpen
mixerGetLineInfoW
mixerGetLineControlsW
mixerClose
waveInGetNumDevs
mixerSetControlDetails
waveInOpen
mixerGetControlDetailsW

ws2_32

WSALookupServiceBeginA
WSALookupServiceNextA
WSALookupServiceEnd
WSAStartup
getsockname
WSACleanup
socket
ioctlsocket
shutdown
connect
WSASendTo
WSASend
ntohs
htonl
ntohl
htons
inet_addr
inet_ntoa
WSAGetLastError
WSACreateEvent
WSAIoctl
WSAResetEvent
WSASetEvent
closesocket
setsockopt
sendto
WSAWaitForMultipleEvents
WSACloseEvent
bind
WSAEventSelect
WSASocketA
select
WSARecv
WSAGetOverlappedResult
__WSAFDIsSet

iphlpapi

GetAdaptersAddresses
GetNetworkParams
GetAdaptersInfo
GetIfEntry

shlwapi

UrlGetPartW
SHGetValueA
SHSetValueA
StrStrW
PathIsDirectoryEmptyW
StrTrimW
PathStripToRootW
PathRemoveFileSpecW
PathRemoveBackslashW
SHSetValueW
PathAddBackslashW
SHGetValueW
PathFindNextComponentW
PathIsPrefixW
PathFileExistsW
PathStripPathW
StrCmpNIA
SHDeleteKeyW
PathIsRelativeW

gdi32

GetObjectA
CreateCompatibleDC
SelectObject
GetDIBits
DeleteDC
DeleteObject

comctl32

ord413
ord410
ord412

msidcrl40

ord34
ord13
ord52
ord21
ord24
ord5
ord16
ord4
ord3
ord38
ord2
ord29
ord8
ord15
ord43
ord41
ord23

dsound

ord11
ord9
ord3

setupapi

SetupInitDefaultQueueCallbackEx
SetupCommitFileQueueW
SetupCloseFileQueue
SetupQueueCopyW
SetupOpenFileQueue
SetupAddToDiskSpaceListW
SetupTermDefaultQueueCallback
SetupCreateDiskSpaceListW
SetupIterateCabinetW
SetupDestroyDiskSpaceList
SetupQuerySpaceRequiredOnDriveW
SetupDefaultQueueCallbackW

wintrust

CryptCATAdminEnumCatalogFromHash
WTHelperProvDataFromStateData
WinVerifyTrustEx
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
WTHelperGetProvSignerFromChain

crypt32

CryptUnprotectData
CryptProtectData
CertVerifyCertificateChainPolicy

msasn1

ASN1BERDecS32Val
ASN1BERDecGeneralizedTime
ASN1BERDecExplicitTag
ASN1BERDecNotEndOfContents
ASN1BERDecPeekTag
ASN1DecAlloc
ASN1BERDecZeroCharString
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncS32
ASN1BEREncEndOfContents
ASN1BERDecOctetString
ASN1BERDecCharString
ASN1BEREncBool
ASN1BERDecBitString
ASN1BERDecU32Val
ASN1CEREncGeneralizedTime
ASN1BEREncCharString
ASN1BEREncBitString
ASN1BEREncOctetString
ASN1BEREncU32
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_Encode
ASN1_Decode
ASN1_CloseDecoder

msvcp90

?_Xran@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 595KB - Virtual size: 595KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5bb48dd5097d2be929363ab0c6d8800

Code Sign

61:02:5a:c7:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:0f:ec:c8:00:00:00:00:00:1bCertificate

Key Usages

fa:32:89:ed:a1:f0:77:44:97:42:f8:9e:7f:fa:a3:e7:ba:c7:67:b8Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

psapi

user32

advapi32

secur32

shell32

version

winhttp

ole32

oleaut32

imm32

d3dx9_37

xinput1_3

winmm

ws2_32

iphlpapi

shlwapi

gdi32

comctl32

msidcrl40

dsound

setupapi

wintrust

crypt32

msasn1

msvcp90

Sections

.text Size: 5.9MB - Virtual size: 5.9MB

.data Size: 595KB - Virtual size: 595KB

.rsrc Size: 6.9MB - Virtual size: 6.9MB

.reloc Size: 203KB - Virtual size: 202KB

61:02:5a:c7:00:00:00:00:00:0f
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:0f:ec:c8:00:00:00:00:00:1b
Certificate

fa:32:89:ed:a1:f0:77:44:97:42:f8:9e:7f:fa:a3:e7:ba:c7:67:b8
Signer

.text
Size: 5.9MB - Virtual size: 5.9MB

.data
Size: 595KB - Virtual size: 595KB

.rsrc
Size: 6.9MB - Virtual size: 6.9MB

.reloc
Size: 203KB - Virtual size: 202KB