sqlceca35[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

sqlceca35.dll
Size

334KB
MD5

48d3292a287a2454801b923b1166f489
SHA1

fbd7501f6a9b46e664aa82d4b569625e4ab20c6d
SHA256

84c214605381c5faaeac7f89edbbc8c9bdca2dad6284377cf0accd6395170099
SHA512

80b8523ef1c5010faff3d319186a53019a9113609f6f27b35294bdff4899e533f4cb6f997099361b41dd71854e7d4fe06e1a2157a0f0cf72fa1a0bf46a21113f
SSDEEP

6144:EcK7mKpypvhHxLXkybCRPw6ms0xH92uahcSzKVOhGmDwfbhHYO8X/XIZni:Ec/UghHxLXkymPc9d6c+KVOhGlVo

Score

1^/10

Malware Config

Signatures

Files

sqlceca35.dll
.dll regsvr32 windows:5 windows x86 arch:x86

cee2487c63f9d5e080ee40d702d5a26b

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

dc:6d:de:18:26:5a:21:90:bb:bd:88:e8:26:1d:8d:c4:5d:28:d6:38
Signer

Actual PE Digest

dc:6d:de:18:26:5a:21:90:bb:bd:88:e8:26:1d:8d:c4:5d:28:d6:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

sqlceca35.pdb

Imports

kernel32

GetLocalTime
GetTickCount
GlobalMemoryStatus
GetFullPathNameW
CloseHandle
RaiseException
Sleep
CreateMutexW
WaitForSingleObject
SetEvent
CreateThread
CreateEventW
LocalFree
GetVersionExA
WriteFile
SetEndOfFile
SetFilePointer
GetFileSize
ReleaseMutex
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
LeaveCriticalSection
GetSystemInfo
OutputDebugStringW
CreateFileW
DeleteFileW
GetFileAttributesW
GetVersionExW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetPrivateProfileSectionW
MoveFileExW
SystemTimeToFileTime
ReadFile
IsDBCSLeadByteEx
GetSystemDefaultLCID
VirtualFree
VirtualAlloc
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
GetLocaleInfoW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryW
GetModuleFileNameW
GetLastError
LoadLibraryW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
InterlockedCompareExchange

crypt32

CryptProtectData
CryptUnprotectData

advapi32

RegEnumValueW
RegQueryValueExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

ole32

CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoGetMalloc
StringFromGUID2
CoCreateInstance

oleaut32

VariantChangeType
VariantCopy
CreateErrorInfo
SetErrorInfo
SysStringLen
SysAllocString
VariantClear
VariantInit
GetErrorInfo
LoadTypeLi
RegisterTypeLi
SysFreeString
SysAllocStringLen

user32

wsprintfW

wininet

InternetOpenW
DetectAutoProxyUrl
HttpSendRequestA
HttpQueryInfoA
InternetCrackUrlW
InternetOpenUrlW
InternetSetOptionW
InternetConnectW
InternetReadFile
HttpOpenRequestW
InternetCloseHandle

msvcr80

mbstowcs
realloc
srand
rand
_itow
_vsnprintf
malloc
_vswprintf
wcscmp
swscanf
wprintf
_wcsnicmp
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
atol
strstr
memset
_strlwr
strlen
wcsrchr
_purecall
memcpy
_vsnwprintf
wcsncpy
wcschr
memcmp
_wtoi
_wcsicmp
wcslen
fseek
ferror
fread
fclose
feof
wcscpy
iswspace
_wfopen
free
sscanf

ws2_32

freeaddrinfo
getnameinfo
getaddrinfo
gethostname
inet_addr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cee2487c63f9d5e080ee40d702d5a26b

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

dc:6d:de:18:26:5a:21:90:bb:bd:88:e8:26:1d:8d:c4:5d:28:d6:38Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

crypt32

advapi32

ole32

oleaut32

user32

wininet

msvcr80

ws2_32

Exports

Exports

Sections

.text Size: 284KB - Virtual size: 284KB

.data Size: 6KB - Virtual size: 10KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 11KB - Virtual size: 11KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

dc:6d:de:18:26:5a:21:90:bb:bd:88:e8:26:1d:8d:c4:5d:28:d6:38
Signer

.text
Size: 284KB - Virtual size: 284KB

.data
Size: 6KB - Virtual size: 10KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 11KB - Virtual size: 11KB