e1rmsg[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1rmsg.dll
Size

74KB
MD5

72e34872d3fc08a0cc4f524a1a75227e
SHA1

08308f090eff2870cf93a00b2b183eb3ead5f48a
SHA256

9231ca7d4a113da10302b9915c4120918dd63d6716dca79f3f4f10c43512f073
SHA512

1b0feca1d7cf9df0c3e82d002285231b431cb5181ca0985bfedb8f5b19c67ce20c7f88fef53d5278466aa5dca05637ff5f371d7a17ef04fadfb92a2eff628e33
SSDEEP

1536:Lzb7zO0MNFHNpPMDixAuSF8+FfNRHmnLhtrrrrrrrrrC/WY:vKzA70rrrrrrrrrIV

Score

1^/10

Malware Config

Signatures

Files

e1rmsg.dll
.dll windows:4 windows x86 arch:x86

Code Sign

33:00:00:b4:a0:79:ac:cd:95:60:34:e6:ae:00:02:00:00:b4:a0
Certificate

Issuer

CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

25/09/2014, 20:18

Not After

25/09/2015, 20:18

Subject

CN=Intel(R) Intel Network Drivers,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:2c:ff:88:00:01:00:00:00:10
Certificate

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Not Before

08/02/2013, 22:21

Not After

08/02/2018, 22:31

Subject

CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

01/02/2013, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:a1:1e:74:fc:0b:87:54:58:0f:50:95:4c:47:c9:4e:67:75:4f:28
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

24/04/2015, 21:46

Not After

24/04/2018, 21:46

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:E892-D055-162F+OU=Thales TSS ESN:E892-D055-162F,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:69:af:57:24:de:d3:e5:8e:9c:bd:26:32:2d:90:75:4a:ad:2e:ad
Signer

Actual PE Digest

24:69:af:57:24:de:d3:e5:8e:9c:bd:26:32:2d:90:75:4a:ad:2e:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:b4:a0:79:ac:cd:95:60:34:e6:ae:00:02:00:00:b4:a0Certificate

Extended Key Usages

Key Usages

61:2c:ff:88:00:01:00:00:00:10Certificate

Key Usages

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88Certificate

Extended Key Usages

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

28:a1:1e:74:fc:0b:87:54:58:0f:50:95:4c:47:c9:4e:67:75:4f:28Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

24:69:af:57:24:de:d3:e5:8e:9c:bd:26:32:2d:90:75:4a:ad:2e:adSigner

Headers

File Characteristics

Sections

.rsrc Size: 56KB - Virtual size: 54KB

.reloc Size: 4KB - Virtual size: 12B

33:00:00:b4:a0:79:ac:cd:95:60:34:e6:ae:00:02:00:00:b4:a0
Certificate

61:2c:ff:88:00:01:00:00:00:10
Certificate

79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

28:a1:1e:74:fc:0b:87:54:58:0f:50:95:4c:47:c9:4e:67:75:4f:28
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

24:69:af:57:24:de:d3:e5:8e:9c:bd:26:32:2d:90:75:4a:ad:2e:ad
Signer

.rsrc
Size: 56KB - Virtual size: 54KB

.reloc
Size: 4KB - Virtual size: 12B