sqlceme35[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

sqlceme35.dll
Size

87KB
MD5

599a60fbdc860779ec1cee5494e324b7
SHA1

c2cc47c949a43a6b9efb35f35f6d106df4e4eb8c
SHA256

ace2a0018c702a6da7db7e7b57362056db47eed82d1cb60a6a708ff109a2125e
SHA512

72562d573276dfa7080df9e686390a8b569edbc953cb06ec651035742d0050448f5e6eaaa8bfbb9f5605e2dc226f34961ee2a2364015819cb33ae22f739a67c2
SSDEEP

1536:NZHc1wMp+fe1ANoteeSdOwzsXIYfg/MPLtAf8oor1+SMYuSho3kSRs/7WOZxN9dp:Nhc1wM6ex1+kuSy0SCTWOZxN9db0u95N

Score

1^/10

Malware Config

Signatures

Files

sqlceme35.dll
.dll windows:5 windows x64 arch:x64

ea15ebbe34d3b66152c2a6ca4fbb4923

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cd:7a:01:bc:80:dd:f8:07:03:ff:38:0f:93:1d:15:4e:a2:80:07:ea
Signer

Actual PE Digest

cd:7a:01:bc:80:dd:f8:07:03:ff:38:0f:93:1d:15:4e:a2:80:07:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sqlceme35.pdb

Imports

kernel32

GetLastError
MultiByteToWideChar
FormatMessageW
GetProcAddress
FreeLibrary
GetLocalTime
MoveFileExW
WaitForSingleObject
WideCharToMultiByte
ReleaseMutex
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
CloseHandle
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetLocaleInfoW
OutputDebugStringW
CreateFileW

ole32

CLSIDFromString
CoCreateGuid

oleaut32

VariantClear
SysAllocStringLen
VariantInit
SysAllocString
SysFreeString

msvcr80

__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
free
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
_wcsnicmp
memcpy
_vsnwprintf
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memset
wcsncpy
_snwprintf
wcsrchr
wprintf
_itow
_vsnprintf
_wcsicmp
_vswprintf

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

DllAddRef
DllCanUnloadNow
DllMain
DllRelease
ME_AbortTransaction
ME_CleanupTombstoneData
ME_CleanupTrackingMetadata
ME_CleanupTransactionData
ME_ClearErrorInfo
ME_CloseStore
ME_CommitTransaction
ME_CompileQueryPlan
ME_CreateCommand
ME_CreateDatabase
ME_CreateErrorInstance
ME_DeleteArray
ME_DeleteRecord
ME_DisableChangeTracking
ME_EnableChangeTracking
ME_ExecuteQueryPlan
ME_ExitChangeTracking
ME_GetBookmark
ME_GetChangeTrackingInfo
ME_GetColumnInfo
ME_GetColumnOrdinal
ME_GetColumnsUpdated
ME_GetContextErrorInfo
ME_GetContextErrorMessage
ME_GetCurrentTrackingTxBsn
ME_GetCurrentTrackingTxCsn
ME_GetDatabaseInstanceID
ME_GetEncryptionMode
ME_GetIndexColumnOrdinals
ME_GetKeyInfo
ME_GetLocale
ME_GetLocaleFlags
ME_GetMinorError
ME_GetNativeVersionInfo
ME_GetParameterInfo
ME_GetSqlCeVersionInfo
ME_GetTrackingContext
ME_GetTrackingOptions
ME_GetTransactionBsn
ME_GetTransactionFlags
ME_GetValues
ME_GotoBookmark
ME_InitChangeTracking
ME_InsertRecord
ME_IsTableChangeTracked
ME_Move
ME_OpenCursor
ME_OpenStore
ME_OpenTransaction
ME_Prepare
ME_Read
ME_ReadAt
ME_Rebuild
ME_SafeDelete
ME_SafeRelease
ME_Seek
ME_SetColumnInfo
ME_SetContextErrorInfo
ME_SetRange
ME_SetTableInfoAsSystem
ME_SetTrackingContext
ME_SetTransactionFlag
ME_SetValue
ME_SetValues
ME_UpdateRecord
uwrda_Pull
uwrda_Push
uwrda_RemoteDataAccess
uwrda_SubmitSql
uwrda_SysFreeString
uwrda_get_CompressionLevel
uwrda_get_ConnectTimeout
uwrda_get_ConnectionManager
uwrda_get_ConnectionRetryTimeout
uwrda_get_ErrorPointer
uwrda_get_InternetLogin
uwrda_get_InternetPassword
uwrda_get_InternetProxyLogin
uwrda_get_InternetProxyPassword
uwrda_get_InternetProxyServer
uwrda_get_InternetUrl
uwrda_get_LocalConnectionString
uwrda_get_ReceiveTimeout
uwrda_get_SendTimeout
uwrda_put_CompressionLevel
uwrda_put_ConnectTimeout
uwrda_put_ConnectionManager
uwrda_put_ConnectionRetryTimeout
uwrda_put_InternetLogin
uwrda_put_InternetPassword
uwrda_put_InternetProxyLogin
uwrda_put_InternetProxyPassword
uwrda_put_InternetProxyServer
uwrda_put_InternetUrl
uwrda_put_LocalConnectionString
uwrda_put_ReceiveTimeout
uwrda_put_SendTimeout
uwrepl_AddSubscription
uwrepl_AsyncReplication
uwrepl_Cancel
uwrepl_DropSubscription
uwrepl_GetSyncResult
uwrepl_Initialize
uwrepl_LoadProperties
uwrepl_ReinitializeSubscription
uwrepl_Replication
uwrepl_Run
uwrepl_SaveProperties
uwrepl_Terminate
uwrepl_WaitForNextStatusReport
uwrepl_get_CompressionLevel
uwrepl_get_ConnectTimeout
uwrepl_get_ConnectionManager
uwrepl_get_ConnectionRetryTimeout
uwrepl_get_Distributor
uwrepl_get_DistributorAddress
uwrepl_get_DistributorLogin
uwrepl_get_DistributorNetwork
uwrepl_get_DistributorPassword
uwrepl_get_DistributorSecurityMode
uwrepl_get_ErrorPointer
uwrepl_get_ExchangeType
uwrepl_get_HostName
uwrepl_get_InternetLogin
uwrepl_get_InternetPassword
uwrepl_get_InternetProxyLogin
uwrepl_get_InternetProxyPassword
uwrepl_get_InternetProxyServer
uwrepl_get_InternetUrl
uwrepl_get_LoginTimeout
uwrepl_get_PostSyncCleanup
uwrepl_get_ProfileName
uwrepl_get_Publication
uwrepl_get_Publisher
uwrepl_get_PublisherAddress
uwrepl_get_PublisherChanges
uwrepl_get_PublisherConflicts
uwrepl_get_PublisherDatabase
uwrepl_get_PublisherLogin
uwrepl_get_PublisherNetwork
uwrepl_get_PublisherPassword
uwrepl_get_PublisherSecurityMode
uwrepl_get_QueryTimeout
uwrepl_get_ReceiveTimeout
uwrepl_get_SendTimeout
uwrepl_get_SnapshotTransferType
uwrepl_get_Subscriber
uwrepl_get_SubscriberChanges
uwrepl_get_SubscriberConflicts
uwrepl_get_SubscriberConnectionString
uwrepl_get_Validate
uwrepl_put_CompressionLevel
uwrepl_put_ConnectTimeout
uwrepl_put_ConnectionManager
uwrepl_put_ConnectionRetryTimeout
uwrepl_put_Distributor
uwrepl_put_DistributorAddress
uwrepl_put_DistributorLogin
uwrepl_put_DistributorNetwork
uwrepl_put_DistributorPassword
uwrepl_put_DistributorSecurityMode
uwrepl_put_ExchangeType
uwrepl_put_HostName
uwrepl_put_InternetLogin
uwrepl_put_InternetPassword
uwrepl_put_InternetProxyLogin
uwrepl_put_InternetProxyPassword
uwrepl_put_InternetProxyServer
uwrepl_put_InternetUrl
uwrepl_put_LoginTimeout
uwrepl_put_PostSyncCleanup
uwrepl_put_ProfileName
uwrepl_put_Publication
uwrepl_put_Publisher
uwrepl_put_PublisherAddress
uwrepl_put_PublisherDatabase
uwrepl_put_PublisherLogin
uwrepl_put_PublisherNetwork
uwrepl_put_PublisherPassword
uwrepl_put_PublisherSecurityMode
uwrepl_put_QueryTimeout
uwrepl_put_ReceiveTimeout
uwrepl_put_SendTimeout
uwrepl_put_SnapshotTransferType
uwrepl_put_Subscriber
uwrepl_put_SubscriberConnectionString
uwrepl_put_Validate
uwutil_ConvertFromDBTIMESTAMP
uwutil_ConvertToDBTIMESTAMP
uwutil_ReleaseCOMPtr
uwutil_SysFreeString
uwutil_ZeroMemory
uwutil_get_Error
uwutil_get_ErrorCount

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea15ebbe34d3b66152c2a6ca4fbb4923

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

cd:7a:01:bc:80:dd:f8:07:03:ff:38:0f:93:1d:15:4e:a2:80:07:eaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

msvcr80

advapi32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 64KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 512B - Virtual size: 364B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

cd:7a:01:bc:80:dd:f8:07:03:ff:38:0f:93:1d:15:4e:a2:80:07:ea
Signer

.text
Size: 64KB - Virtual size: 64KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 512B - Virtual size: 364B