libcurl[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

libcurl.dll
Size

532KB
MD5

8da7e810e0f12b16fe6087aadda7a69c
SHA1

e76539074da170bf52a9cc06863ff8cb498c76e6
SHA256

79f567797066f6206ea870ffda11cf92612aea0ee3a26582be38ddd0fd51fa53
SHA512

7d9d40e501c9128cb81af785091aaca60b8b92af57a69f1f498bd810431e3521f9431161f8c3e4061b7e0ba2c3dfc8034e66bc4c05f5e39941623b04d367775d
SSDEEP

6144:y6NI7/hgoJrPOkFVuW6ZoiPPnk/9AAQIPGBxTShA9ZvT6QKob6LHywHFE1P+wTt4:u/ZhPxVOdk/4IPETvzhHuzE1P+wTt4

Score

1^/10

Malware Config

Signatures

Files

libcurl.dll
.dll windows:6 windows x64 arch:x64

5358152c0d79f70fd94d03415e08ddbe

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03-05-2019 00:00

Not After

11-05-2022 12:00

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:72:1f:92:20:53:08:c6:de:a0:a9:f2:a3:a6:84:7c:d4:2a:1c:24
Signer

Actual PE Digest

d7:72:1f:92:20:53:08:c6:de:a0:a9:f2:a3:a6:84:7c:d4:2a:1c:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

ntohl
htonl
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
sendto
recvfrom
select
__WSAFDIsSet
WSAIoctl
WSASetLastError
socket
setsockopt
getsockopt
getpeername
connect
closesocket
WSACleanup
WSAStartup
ntohs
listen
htons
getsockname
bind
accept
WSAGetLastError
send
recv

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143

advapi32

CryptDestroyHash
CryptGenRandom
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext

normaliz

IdnToAscii

crypt32

CertFreeCertificateContext

kernel32

GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
HeapReAlloc
FlushFileBuffers
LCMapStringW
CompareStringW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetACP
HeapAlloc
HeapFree
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
GetFileAttributesExW
GetStringTypeW
GetTimeZoneInformation
HeapSize
WriteConsoleW
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetTickCount64
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
GetLastError
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
GetProcAddress
SleepEx
SetLastError
FormatMessageA
Sleep
CloseHandle
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
RaiseException
VerifyVersionInfoA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5358152c0d79f70fd94d03415e08ddbe

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

d7:72:1f:92:20:53:08:c6:de:a0:a9:f2:a3:a6:84:7c:d4:2a:1c:24Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

advapi32

normaliz

crypt32

kernel32

Exports

Exports

Sections

.text Size: 387KB - Virtual size: 386KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 20KB - Virtual size: 19KB

.gfids Size: 512B - Virtual size: 160B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

d7:72:1f:92:20:53:08:c6:de:a0:a9:f2:a3:a6:84:7c:d4:2a:1c:24
Signer

.text
Size: 387KB - Virtual size: 386KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 20KB - Virtual size: 19KB

.gfids
Size: 512B - Virtual size: 160B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB