Microsoft[.]Data[.]SqlClient[.]SNI[.]x86[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Microsoft.Data.SqlClient.SNI.x86.dll
Size

422KB
MD5

04e7ccec49519900555a0a4024f71829
SHA1

8dedbdb9d15b4cd1273d2e32c810638952ade0bd
SHA256

83255469619b66e9c2a9d21171873a862b1258df060f4d202298983c618e77e0
SHA512

63fbdf335ab98407a572fb628df81c59a0abf2b583d0f5b50857e1808b4a6ebbe36cbcf0b3c5f5b35caa3e2ba47b1a4eb2b2134cce3266c652f2c8e56e5abb81
SSDEEP

12288:C4Dm2gYU2b2bT+edag+UmyJCo9v1ZjT1Awa02BaJRHSxA:QD2/eNV9vTO02Sym

Score

1^/10

Malware Config

Signatures

Files

Microsoft.Data.SqlClient.SNI.x86.dll
.dll windows:6 windows x86 arch:x86

005815677b35a5bfba6d6f4a549c147d

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:90:78:12:0b:20:ed:9b:d9:c0:bb:88:e6:6c:09:11:46:23:eb:34:03:a7:11:29:d9:44:69:ee:6e:91:87:92
Signer

Actual PE Digest

b5:90:78:12:0b:20:ed:9b:d9:c0:bb:88:e6:6c:09:11:46:23:eb:34:03:a7:11:29:d9:44:69:ee:6e:91:87:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Data.SqlClient.SNI.pdb

Imports

kernel32

InitializeSListHead
CreateIoCompletionPort
TlsSetValue
MultiByteToWideChar
FormatMessageW
TlsAlloc
TlsGetValue
TlsFree
FormatMessageA
SetHandleInformation
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
FindFirstFileExW
WaitNamedPipeW
GetTickCount
GetOverlappedResult
Sleep
DisconnectNamedPipe
CreateFileW
PeekNamedPipe
WriteFile
GetCurrentProcess
SetLastError
SetNamedPipeHandleState
ReadFile
LoadLibraryA
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetSystemTimeAsFileTime
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
CreateEventW
PostQueuedCompletionStatus
CreateSemaphoreW
DeleteCriticalSection
SystemTimeToTzSpecificLocalTime
FindClose
CloseHandle
GetLastError
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
WriteConsoleW
DecodePointer
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
VerifyVersionInfoW
GetComputerNameW
VerSetConditionMask
CreateThread
GetSystemDirectoryA
FileTimeToSystemTime
CompareStringA
GetVersionExW
GetQueuedCompletionStatus
SetEvent
WaitForMultipleObjects
WideCharToMultiByte
LCMapStringW
CompareStringW
QueryDepthSList
SetFileCompletionNotificationModes
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ExitProcess
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindNextFileW

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RevertToSelf
ImpersonateNamedPipeClient
EventRegister
EventUnregister
EventWriteTransfer
IsTokenRestricted

rpcrt4

UuidCreate

user32

CharNextW
CharNextA
CharNextExA

ws2_32

ntohs
connect
WSAEnumProtocolsW
WSARecv
WSAPoll
WSACleanup
__WSAFDIsSet
FreeAddrInfoW
closesocket
select
getsockname
WSAStartup
socket
GetAddrInfoW
recv
htonl
htons
sendto
setsockopt
getpeername
WSAGetLastError
bind
shutdown
WSASend
GetNameInfoW
WSAIoctl
WSAStringToAddressW

crypt32

CryptStringToBinaryW
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertVerifyTimeValidity
CertFreeCertificateContext
CertOpenSystemStoreA
CryptAcquireCertificatePrivateKey
CertGetCertificateContextProperty

Exports

Exports

?_TlgEvent@?6??SNIPacketRelease@@9@4U<unnamed-type-_TlgEvent>@?6??1@YAXPAVSNI_Packet@@@Z@B
?_TlgEvent@?BC@??SNIPacketRelease@@9@4U<unnamed-type-_TlgEvent>@?BC@??1@YAXPAVSNI_Packet@@@Z@B
?_TlgEvent@?BN@??SNIPacketRelease@@9@4U<unnamed-type-_TlgEvent>@?BN@??1@YAXPAVSNI_Packet@@@Z@B
GetSniMaxComposedSpnLength
SNIAddProviderWrapper
SNICheckConnectionWrapper
SNICloseWrapper
SNIGetInfoWrapper
SNIGetLastError
SNIGetPeerAddrStrWrapper
SNIInitialize
SNIOpenSyncExWrapper
SNIOpenWrapper
SNIPacketAllocateWrapper
SNIPacketGetDataWrapper
SNIPacketRelease
SNIPacketResetWrapper
SNIPacketSetData
SNIQueryInfo
SNIReadAsyncWrapper
SNIReadSyncOverAsync
SNIRemoveProviderWrapper
SNISecGenClientContextWrapper
SNISecInitPackage
SNISetInfoWrapper
SNITerminate
SNIWaitForSSLHandshakeToCompleteWrapper
SNIWriteAsyncWrapper
SNIWriteSyncOverAsync
UnmanagedIsTokenRestricted

Sections

.text
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

005815677b35a5bfba6d6f4a549c147d

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

b5:90:78:12:0b:20:ed:9b:d9:c0:bb:88:e6:6c:09:11:46:23:eb:34:03:a7:11:29:d9:44:69:ee:6e:91:87:92Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

rpcrt4

user32

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 311KB - Virtual size: 311KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 3KB - Virtual size: 21KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 19KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b5:90:78:12:0b:20:ed:9b:d9:c0:bb:88:e6:6c:09:11:46:23:eb:34:03:a7:11:29:d9:44:69:ee:6e:91:87:92
Signer

.text
Size: 311KB - Virtual size: 311KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 3KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 19KB