wd553db[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wd553db.dll
Size

213KB
MD5

b8538514c5ea6d2abb218304ce0a1e13
SHA1

cb360ad66427ea603f6af6da95865b93994e1e4a
SHA256

c222002788a0d94db404b9bd8a64fc8c2fbcd17bf98fd5e76730a1a93b77d750
SHA512

e9ec068416abc5e64840c4f40c2fee41e6600f53d07940084546fb4db66e8fe98ad35b2cf1f93bac218d08c464ce36c1026b82ce6bfdec4dc964dd032969355a
SSDEEP

3072:ZYncWYen1K2PBGMjplOmzFnvo4TELrWs2Ho4VZq16WP/dAUXeR3:qcXe1KqG07OmzFI2IqIXM

Score

1^/10

Malware Config

Signatures

Files

wd553db.dll
.dll windows:4 windows x86 arch:x86

420c98892e0a1076d1cf73a81db4d645

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7f:b2:86:d4:53:b5:c5:7e:8e:09:c9:c9:94:06:8b:9b
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

05/10/2017, 00:00

Not After

04/12/2019, 23:59

Subject

CN=PC SOFT INFORMATIQUE,OU=Quality Assurance,O=PC SOFT INFORMATIQUE,L=MONTPELLIER,ST=Hérault,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b7:52:88:73:3a:60:ea:0a:32:ea:32:62:b0:a5:41:f6:75:d3:cb:95
Signer

Actual PE Digest

b7:52:88:73:3a:60:ea:0a:32:ea:32:62:b0:a5:41:f6:75:d3:cb:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalUnlock
GlobalHandle
GlobalLock
LocalAlloc
LocalReAlloc
LocalFree
LocalUnlock
LocalFlags
LocalLock
GetCurrentProcess
GetVersion
SetErrorMode
GetLastError
GetFileAttributesA
GlobalFree
GlobalFlags
ReadFile
WriteFile
SetFilePointer
CloseHandle
DeleteFileA
LockFile
UnlockFile
SetEndOfFile
FlushFileBuffers
SetHandleCount
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateFileA
GlobalAlloc
LCMapStringA
MultiByteToWideChar
HeapReAlloc
CompareStringW
CompareStringA
GlobalReAlloc
WideCharToMultiByte
LoadLibraryA
GetLocaleInfoA
SetStdHandle
VirtualAlloc
MoveFileA
SetEnvironmentVariableA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetLocaleInfoW
GetStartupInfoA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapFree
HeapAlloc
TerminateProcess
HeapDestroy
HeapCreate
VirtualFree
GetFileType
GetStdHandle
GetEnvironmentStrings
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW

Exports

Exports

SCCDGSTYLE
SCCDI2L
SCCDI2S
SCCDIGET
SCCDILEAP
SCCDIPERM
SCCDL2DOW
SCCDL2I
SCCDL2SX
SCCDS2DAY
SCCDS2DOW
SCCDS2I
SCCDS2LX
SCCDS2MON
SCCDS2S
SCCDSDAY
SCCDSDIFF
SCCDSGET
SCCDSLEAP
SCCDSMONTH
SCCDSPERM
SCCDSTYLE
SCCDSVALID
SCCTI2S
SCCTIGET
SCCTS2I
SCCTSDIFF
SCCTSGET
SCCTSVALID
SCDCCLOSE
SCDCCREATE
SCDCEXPR
SCDCHGET
SCDCINDEX
SCDCINFO
SCDCKADD
SCDCKBOT
SCDCKCUR
SCDCKDATE
SCDCKDEL
SCDCKFIND
SCDCKMAKE
SCDCKMAKEH
SCDCKNEXT
SCDCKNUM
SCDCKPREV
SCDCKTOP
SCDCOPENX
SCDDCLOSE
SCDDCREATE
SCDDFGET
SCDDFGETS
SCDDFINFO
SCDDFLUSH
SCDDFNAM2NO
SCDDFNGET
SCDDFNGETS
SCDDFNO2NAM
SCDDFNPUT
SCDDFNPUTS
SCDDFPUT
SCDDFPUTS
SCDDHGET
SCDDHLOCK
SCDDINFO
SCDDLOCK
SCDDLUD
SCDDOPENX
SCDDPACK
SCDDRCLEAR
SCDDRDEL
SCDDRGET
SCDDRGETX
SCDDRINFO
SCDDRINFOH
SCDDRLOCK
SCDDRNUM
SCDDRPUT
SCDDRPUTX
SCDDRSTAT
SCDDRUNDEL
SCDDSIZE
SCDDUNLOCK
SCDICLOSE
SCDICREATE
SCDIEXPR
SCDIHGET
SCDIINDEX
SCDIINFO
SCDIKADD
SCDIKBOT
SCDIKCUR
SCDIKDATE
SCDIKDEL
SCDIKFIND
SCDIKMAKE
SCDIKMAKEH
SCDIKNEXT
SCDIKNUM
SCDIKPREV
SCDIKTOP
SCDIKTYPE
SCDINIT
SCDIOPENX
SCDMCLOSE
SCDMCREATE
SCDMCREATEX
SCDMINFO
SCDMKADD
SCDMKBOT
SCDMKCUR
SCDMKDATE
SCDMKDEL
SCDMKFIND
SCDMKMAKE
SCDMKMAKEH
SCDMKNEXT
SCDMKNUM
SCDMKPREV
SCDMKTOP
SCDMOPENX
SCDMTCLOSE
SCDMTERASE
SCDMTEXPR
SCDMTHGET
SCDMTINDEX
SCDMTINFO
SCDMTNEW
SCDMTUSE
SCDMTUSEX
SCDNCLOSE
SCDNCREATE
SCDNEXPR
SCDNHGET
SCDNINDEX
SCDNINFO
SCDNKADD
SCDNKBOT
SCDNKCUR
SCDNKDATE
SCDNKDEL
SCDNKFIND
SCDNKMAKE
SCDNKMAKEH
SCDNKNEXT
SCDNKNUM
SCDNKPREV
SCDNKTOP
SCDNOPENX
SCDQCLOSE
SCDTCLOSE
SCDTCREATE
SCDTCREATEX
SCDTERM
SCDTHGET
SCDTINFO
SCDTOPENX
SCDTPACK
SCDTRGET
SCDTRGETH
SCDTRPUT
SCDVERSION
SCDWCLOSE
SCDWCREATE
SCDWHGET
SCDWINFO
SCDWOPENX
SCDWPACK
SCDWRGET
SCDWRGETH
SCDWRPUT
SCDXADD
SCDXDEL
SCDXEVAL
SCDXINFO
SCDXKCMP
SCDXLIST
SCDXPROC
SCDXVGET
SCECODE
SCESCODE
SCESLOG
SCFORMATDATE
SCMFREE
SCTYPETRI
WD5InitInstance
_SCDNKCMP
_SCMALLOC
_SCMFREE
_SCMLOCK
_SCMRALLOC
_SCMUNLOCK

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

420c98892e0a1076d1cf73a81db4d645

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7f:b2:86:d4:53:b5:c5:7e:8e:09:c9:c9:94:06:8b:9bCertificate

Extended Key Usages

Key Usages

b7:52:88:73:3a:60:ea:0a:32:ea:32:62:b0:a5:41:f6:75:d3:cb:95Signer

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 163KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 11KB - Virtual size: 18KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 13KB - Virtual size: 13KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7f:b2:86:d4:53:b5:c5:7e:8e:09:c9:c9:94:06:8b:9b
Certificate

b7:52:88:73:3a:60:ea:0a:32:ea:32:62:b0:a5:41:f6:75:d3:cb:95
Signer

.text
Size: 164KB - Virtual size: 163KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 11KB - Virtual size: 18KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 13KB - Virtual size: 13KB