desvm[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

desvm.dll
Size

4.0MB
MD5

8adc5adef99c6964cc1a1ee3f237a379
SHA1

669cb4db01432c0108dd6ffefeef8d90fd9fa123
SHA256

909ea9e88f7483afbe13e54d51c815f2e520caac39f9e038214172b957ad6819
SHA512

c2d2e2624abdb1285646bcbb049c05175e61e9e7a64fc89b51ddf62cee6a0787b9e718948b15ea7bd50ae4f4b91989207d704fc454c2bb00ac7765505f9e4b98
SSDEEP

98304:bFstHdP6faUF4mm8DEyV2iAHs+9IMJHhsEh:bFst9P6So2dHxHhsC

Score

1^/10

Malware Config

Signatures

Files

desvm.dll
.dll windows:5 windows x86 arch:x86

20fd68f5b8917f7f67d470681cbe9623

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7f:b2:86:d4:53:b5:c5:7e:8e:09:c9:c9:94:06:8b:9b
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

05/10/2017, 00:00

Not After

04/12/2019, 23:59

Subject

CN=PC SOFT INFORMATIQUE,OU=Quality Assurance,O=PC SOFT INFORMATIQUE,L=MONTPELLIER,ST=Hérault,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2a:c2:81:ef:c7:40:2e:c5:76:f7:b8:6c:5a:9b:28:53:1e:5a:09:d7
Signer

Actual PE Digest

2a:c2:81:ef:c7:40:2e:c5:76:f7:b8:6c:5a:9b:28:53:1e:5a:09:d7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

B:\source\source.YB\99982\Release_wdvm_96\wx\Desktop_x86_32\Release\wd230vm.PDB

Imports

kernel32

WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
InterlockedExchangeAdd
SetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetSystemTime
GetProcAddress
MulDiv
LocalAlloc
LocalFree
GetVersionExW
GetModuleHandleW
LoadLibraryW
GetFileInformationByHandle
GetLogicalDriveStringsW
GetVolumeInformationW
CloseHandle
WriteFile
GetLastError
ReadFile
SetFilePointer
LockFile
LockFileEx
UnlockFile
UnlockFileEx
FlushFileBuffers
SetEndOfFile
SetFileValidData
SetErrorMode
SystemTimeToFileTime
FileTimeToSystemTime
CreateFileW
GetTickCount
Sleep
DeleteFileW
CopyFileW
CreateDirectoryW
FindFirstFileW
FindClose
GetFileAttributesW
SetFileAttributesW
FindFirstFileExW
FindNextFileW
GetTempPathW
GetCurrentDirectoryW
GetTempFileNameW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetFullPathNameW
GetDriveTypeW
QueryDosDeviceW
FileTimeToLocalFileTime
HeapFree
GetProcessHeap
HeapAlloc
FindResourceW
LoadResource
LockResource
FreeLibrary
IsBadReadPtr
GetModuleFileNameW
VirtualQuery
GetModuleFileNameA
GetSystemInfo
GetCurrentProcess
GetCurrentProcessId
GetPrivateProfileStringW
GetCurrentThreadId
CreateThread
WaitForSingleObject
TerminateProcess
InterlockedExchange
GetProfileStringW
SetUnhandledExceptionFilter
RaiseException
GetProfileIntW
SearchPathW
HeapCreate
HeapDestroy
HeapReAlloc
CompareStringW
CompareStringA
GetSystemDefaultLCID
FormatMessageW
GetTimeZoneInformation
CreateEventW
SetEvent
ResetEvent
GetUserDefaultLangID
CreateMutexW
ReleaseMutex
OpenMutexW
CreateSemaphoreW
ReleaseSemaphore
WaitForMultipleObjects
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileIntW
IsDebuggerPresent
TlsGetValue
VirtualProtect
QueryPerformanceCounter
GetLocaleInfoW
IsBadWritePtr
TlsSetValue
OpenEventW
LCMapStringA
LCMapStringW
GlobalMemoryStatusEx
GetCommandLineW
TlsAlloc
TlsFree
CreateProcessW
GetComputerNameW
GlobalAlloc
GlobalLock
GlobalUnlock
LoadLibraryExW
WritePrivateProfileStringW
QueryPerformanceFrequency
ResumeThread
PulseEvent
SuspendThread
SetThreadPriority
VirtualAlloc
VirtualFree
OutputDebugStringW
TerminateThread
GetProcessAffinityMask
SizeofResource
WinExec
GetNumberFormatW
GetCurrencyFormatW
LoadLibraryExA
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetStringTypeW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetACP
GetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetConsoleCP
GetConsoleMode
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetFilePointerEx
WriteConsoleW
HeapSize
ReadConsoleW
EncodePointer
DecodePointer

Exports

Exports

CheckVersion
CommandeComposante
DeclareProxy
EXT_LibereContexteExterne
EXT_Term
EXT_bAppelDelegue
EXT_bAppelMethodeInstance
EXT_bAppelMethodeStatique
EXT_bChargeWDL
EXT_bChargeWDLRes
EXT_bExecuteInitialisation
EXT_bExecuteTerminaison
EXT_bGetMembreInstance
EXT_bGetMembreStatique
EXT_bGetVariableCollection
EXT_bInit
EXT_bLibereInstance
EXT_bSetMembreInstance
EXT_bSetMembreStatique
EXT_bSetVariableCollection
EXT_pAlloueInstance
EXT_pCreeContexteExterne
EXT_piGetVMExterne
EXT_pszGetMessageErreur
EXT_pszGetMessageErreurDelegue
Execution
FinConversion
InfoComposante
InfoVersionWeb
InitDLL
InitDLLEx
OBJ_pclGetTauxDeChange
TermDLL
TermLibrary
WLEFermeWDLNum
WLEFermeWDLRes
WLEFermeWDLResMyModule
WLEReprise
WLETerm
WL_CheminDLL
WL_CheminDLL_W
WL_DonneFinInit
WL_DonneGPU
WL_DonneGPU_W
WL_DonneREP
WL_DonneREP_W
WL_DonneWDL
WL_DonneWDL_W
WL_InitGoRequete
WL_ListeDLL
WL_ListeDLL_W
WL_ListeWDL
WL_ListeWDL_W
WL_Run_Res
WL_Run_Res_Cmd
WL_Run_Res_Cmd_W
WL_Run_Res_W
WL_Run_Service
WL_Run_Service_Cmd
WL_Run_Service_Cmd_W
WL_Run_Service_W
WL_SetParam
WL_Term_Service
WL_TestEx
WL_TestEx_W
bCanCompare
bCanCompareEx
bInitLibrary
bIsBoolean
bIsString
bIsStringAW
bNegatif
bWL_MultiRemoteControl_A
bWL_MultiRemoteControl_W
bWL_RemoteControl_A
bWL_RemoteControl_W
nAddition
nAdditionEx
nCommencePar
nCommenceParEx
nCommenceParSouple
nCommenceParSoupleEx
nCommenceParTresSouple
nCommenceParTresSoupleEx
nComparaison
nComparaisonEx
nContientEx
nContientSoupleEx
nContientTresSoupleEx
nConversion
nConversionDepassement
nConversionDepassementEx
nConversionDepassementExt
nDivision
nDivisionEx
nETLogique
nETLogiqueEx
nEgalite
nEgaliteEx
nInferieur
nInferieurEx
nModulo
nModuloEx
nMultiplication
nMultiplicationEx
nNONLogique
nNONLogiqueEx
nNegation
nNegationEx
nOULogique
nOULogiqueEx
nPresqueEgal
nPresqueEgalEx
nSoupleEgal
nSoupleEgalEx
nSoustraction
nSoustractionEx
nSuperieur
nSuperieurEx
nTermineParEx
nTermineParSoupleEx
nTermineParTresSoupleEx
nWLEAppelle
nWLEAppelleEx
nWLEChampExiste
nWLEChampExisteA
nWLECompile
nWLECompileA
nWLEEcritPropElem
nWLEEcritPropElemA
nWLEEcritPropElemCle
nWLEEcritPropElemCleA
nWLEEcritPropElemInd
nWLEEcritPropElemInd2
nWLEEcritPropElemInd2A
nWLEEcritPropElemIndA
nWLEEcritPropSousElem
nWLEEcritPropSousElemA
nWLEEcritPropSousElemInd
nWLEEcritPropSousElemIndA
nWLEEcritVariableWL
nWLEEmpile
nWLEEmpileEx
nWLEEvalue
nWLEEvalueA
nWLEExecute
nWLEExecuteA
nWLEExecuteProcedure
nWLEExecuteProcedureA
nWLEExecuteTraitement
nWLEExecuteTraitementA
nWLEGetHFContext
nWLEGetIEXE
nWLEGetLibShop
nWLEGetVM
nWLEGetVMData
nWLEInit
nWLEInitEx
nWLEInitProjet
nWLELitPropElem
nWLELitPropElemA
nWLELitPropElemAny
nWLELitPropElemAnyA
nWLELitPropElemAnyInd
nWLELitPropElemAnyInd2
nWLELitPropElemAnyInd2A
nWLELitPropElemAnyIndA
nWLELitPropElemCle
nWLELitPropElemCleA
nWLELitPropElemInd
nWLELitPropElemInd2
nWLELitPropElemInd2A
nWLELitPropElemIndA
nWLELitPropSousElem
nWLELitPropSousElemA
nWLELitPropSousElemInd
nWLELitPropSousElemIndA
nWLELitVariableWL
nWLEOPMT
nWLEOperation
nWLEOuvreWDL
nWLEOuvreWDLA
nWLEOuvreWDLEx
nWLEOuvreWDLExMyModule
nWLEOuvreWDLNum
nWLEOuvreWDLNumA
nWLEOuvreWDLRes
nWLEOuvreWDLResMyModule
nWLESetCallback
nWLESetCallbackA
nWLESetCallbackModule
nWLESetCallbackModuleA
nWLESetCompatible
nWLESetCompatibleA
nWLESetHFContext
nWLESetPECallback
nWLESetPECallbackA
nWLESetParent
nWLETermProjet
pQueryProxy
pWLEChercheContexteElement
pWLEChercheContexteElementA
pWLEGetContexteElement
pWLEModifieContexteElement
pWLERestaureContexteElement
pWLESetCallbackElement
pWLESetCallbackElementA
wAjoute
wAjouteEx
wDivise
wDiviseEx
wModulo
wModuloEx
wMultiplie
wMultiplieEx
wSoustrait
wSoustraitEx

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20fd68f5b8917f7f67d470681cbe9623

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7f:b2:86:d4:53:b5:c5:7e:8e:09:c9:c9:94:06:8b:9bCertificate

Extended Key Usages

Key Usages

2a:c2:81:ef:c7:40:2e:c5:76:f7:b8:6c:5a:9b:28:53:1e:5a:09:d7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 623KB - Virtual size: 623KB

.data Size: 46KB - Virtual size: 58KB

.gfids Size: 512B - Virtual size: 288B

.rsrc Size: 197KB - Virtual size: 197KB

.reloc Size: 180KB - Virtual size: 180KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7f:b2:86:d4:53:b5:c5:7e:8e:09:c9:c9:94:06:8b:9b
Certificate

2a:c2:81:ef:c7:40:2e:c5:76:f7:b8:6c:5a:9b:28:53:1e:5a:09:d7
Signer

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 623KB - Virtual size: 623KB

.data
Size: 46KB - Virtual size: 58KB

.gfids
Size: 512B - Virtual size: 288B

.rsrc
Size: 197KB - Virtual size: 197KB

.reloc
Size: 180KB - Virtual size: 180KB