libxslt[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

libxslt.dll
Size

217KB
MD5

4541880780e53861158a4db12884a057
SHA1

c5316bb117e28023f58f1e06d20ed71c106b7679
SHA256

d31be30614f8a847810a21762c3d1b1a976a1e710bbf1fc4533d5793a72879d3
SHA512

5dc0d37e8ff9473b2814e2cd6cc4dda9cd8c46b6ca7a651b3a52b03a77258d1e8bd0d6581e69309f2bd25dbf71dee0e2d2be1e55d93120799515d0adad58dedf
SSDEEP

3072:oOKuGzYaqn1EF/KSgb4rGUAB+JFqGG3bzcS4YakfX+1IBMA5AlLq7uplDY1t:ta2uZ/AwrckZYtX+1u5qCkDSt

Score

1^/10

Malware Config

Signatures

Files

libxslt.dll
.dll windows:6 windows x64 arch:x64

3096cbe65bfb0015f7e13209a1189445

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/04/2021, 00:00

Not After

01/05/2024, 23:59

Subject

CN=LLC 1C-Soft,OU=LLC 1C-Soft,O=LLC 1C-Soft,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:bb:bb:82:e8:d3:64:1e:07:9f:d1:cf:54:03:78:d5:af:60:53:70:ab:0f:a7:5a:54:ca:37:7e:5a:1d:e8:c8
Signer

Actual PE Digest

50:bb:bb:82:e8:d3:64:1e:07:9f:d1:cf:54:03:78:d5:af:60:53:70:ab:0f:a7:5a:54:ca:37:7e:5a:1d:e8:c8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\ext\WKR\src\buildtrees\libxslt\x64-windows-webkit-rel\libxslt.pdb

Imports

libxml2-v8

xmlXPathConvertString
xmlXPathErr
xmlXPathNsLookup
xmlXPathRegisterFunc
xmlXPathFunctionLookupNS
valuePop
valuePush
xmlXPathNewString
xmlXPathNewCString
xmlXPathNewBoolean
xmlXPathNewNodeSet
xmlXPathNodeSetMerge
xmlXPathWrapNodeSet
xmlXPathStringFunction
xmlXPathNumberFunction
xmlBuildURI
xmlParseURI
xmlSaveUri
xmlFreeURI
xmlXPathNodeSetCreate
xmlXPathFreeNodeSet
xmlXPathCastNodeToString
xmlXPathCastToString
xmlXPathCompiledEval
xmlXPathNodeSetAdd
xmlNewNs
xmlSearchNsByHref
xmlStrncmp
xmlStrlen
xmlUTF8Strsize
xmlUTF8Strpos
xmlUTF8Strloc
xmlBufferCreate
xmlBufferFree
xmlBufferAdd
xmlBufferCat
xmlBufferCCat
xmlBufferContent
xmlCharInRange
xmlStringCurrentChar
xmlCopyCharMultiByte
xmlXPathEvalExpression
xmlXPathIsNaN
xmlXPathIsInf
xmlXPathNewParserContext
xmlXPathFreeParserContext
xmlXPathNextAncestor
xmlXPathNextPrecedingSibling
xmlIsBaseCharGroup
xmlIsDigitGroup
xmlHashAddEntry3
xmlHashUpdateEntry3
xmlHashLookup3
xmlGetID
xmlXPathEval
xmlXPathIsNodeType
xmlIsCombiningGroup
xmlIsExtenderGroup
xmlStrncasecmp
xmlCreateURI
xmlDictOwns
xmlNewDocProp
xmlNewNsProp
xmlNewDocNode
xmlFreeNodeList
xmlFreeNode
xmlStrcat
xmlXPathEvalPredicate
xmlXPathCtxtCompile
xmlXPathRegisterFuncNS
xmlDictCreateSub
xmlDictQLookup
xmlCreateIntSubset
xmlGetIntSubset
xmlFreeDtd
xmlNewDoc
xmlXPathCmpNodes
xmlNewDocText
xmlNewDocPI
xmlNewTextLen
xmlNewCDataBlock
xmlDocCopyNode
xmlIsBlankNode
xmlUnlinkNode
xmlNodeListGetString
xmlNodeAddContent
xmlXPathNewContext
xmlXPathFreeContext
xmlXPathContextSetCache
xmlXPathCompiledEvalToBoolean
xmlXPathInit
xmlXPathRegisterVariableLookup
xmlXPathRegisterFuncLookup
xmlXPathNodeSetAddUnique
htmlNewDoc
htmlNewDocNoDtD
xmlURIEscapeStr
xmlGenericError
xmlGenericErrorContext
xmlStringText
xmlFreeIDTable
xmlFreeRefTable
xmlXPathNewValueTree
xmlDictCreate
xmlValidateNCName
xmlAddPrevSibling
xmlNodeSetContent
xmlNodeGetSpacePreserve
xmlHashUpdateEntry
xmlNewRMutex
xmlFreeRMutex
xmlXPathStringEvalNumber
xmlStrcmp
xmlRMutexLock
xmlRMutexUnlock
xmlBufContent
xmlBufUse
xmlGetLineNo
xmlGetProp
xmlNodeDumpOutput
xmlGetDtdAttrDesc
xmlFindCharEncodingHandler
xmlGetCharEncodingName
xmlAllocOutputBuffer
xmlOutputBufferCreateFilename
xmlOutputBufferCreateFile
xmlOutputBufferCreateFd
xmlOutputBufferWriteString
xmlOutputBufferFlush
xmlOutputBufferClose
htmlSetMetaEncoding
htmlDocContentDumpOutput
htmlDocContentDumpFormatOutput
xmlXPathConvertNumber
xmlStrchr
xmlStrndup
xmlStringTextNoenc
xmlFree
xmlMalloc
xmlIsID
xmlFreeMutex
xmlMutexUnlock
xmlMutexLock
xmlNewMutex
xmlHashScan
xmlHashLookup
xmlHashRemoveEntry
xmlHashUpdateEntry2
xmlXPathObjectCopy
xmlXPathFreeObject
xmlGetDocEntity
xmlHashAddEntry
xmlAddChild
xmlNewComment
xmlNodeGetBase
xmlXPathOrderDocElems
inputPush
xmlSplitQName2
xmlNewDocNodeEatName
xmlCtxtUseOptions
xmlLoadExternalEntity
xmlFreeParserCtxt
xmlNewParserCtxt
xmlParseDocument
xmlParserGetDirectory
xmlDocGetRootElement
xmlFreeDoc
xmlDictFree
xmlDictReference
xmlRealloc
xmlXPathFreeCompExpr
xmlStrstr
xmlGetNsList
xmlStrcasecmp
xmlStrncat
xmlAddID
xmlHashScanFull
xmlHashLookup2
xmlHashRemoveEntry2
xmlHashAddEntry2
xmlHashFree
xmlHashCreate
xmlGetNsProp
xmlSetNsProp
xmlSearchNs
xmlNewText
xmlValidateQName
xmlDictLookup
xmlStrEqual
xmlNodeGetContent
xmlStrdup

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EnumSystemLocalesA
GetLocaleInfoA
MultiByteToWideChar
CompareStringW
GetFileAttributesA
IsDebuggerPresent

vcruntime140

memcpy
memset
__C_specific_handler
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

fclose
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
__acrt_iob_func
fopen

api-ms-win-crt-math-l1-1-0

pow
fmod
floor

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_mkdir

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_execute_onexit_table
_cexit
_seh_filter_dll
_initterm

Exports

Exports

xslDebugStatus
xsltAddKey
xsltAddStackElemList
xsltAddTemplate
xsltAllocateExtra
xsltAllocateExtraCtxt
xsltApplyAttributeSet
xsltApplyImports
xsltApplyOneTemplate
xsltApplyStripSpaces
xsltApplyStylesheet
xsltApplyStylesheetUser
xsltApplyTemplates
xsltAttrListTemplateProcess
xsltAttrTemplateProcess
xsltAttrTemplateValueProcess
xsltAttrTemplateValueProcessNode
xsltAttribute
xsltCallTemplate
xsltCheckExtPrefix
xsltCheckExtURI
xsltCheckRead
xsltCheckWrite
xsltChoose
xsltCleanupGlobals
xsltCleanupTemplates
xsltComment
xsltCompMatchClearCache
xsltCompileAttr
xsltCompilePattern
xsltComputeSortResult
xsltCopy
xsltCopyNamespace
xsltCopyNamespaceList
xsltCopyOf
xsltCopyTextString
xsltCreateRVT
xsltDebug
xsltDebugDumpExtensions
xsltDebugGetDefaultTrace
xsltDebugSetDefaultTrace
xsltDecimalFormatGetByName
xsltDecimalFormatGetByQName
xsltDefaultSortFunction
xsltDoSortFunction
xsltDocDefaultLoader
xsltDocumentComp
xsltDocumentElem
xsltDocumentFunction
xsltDocumentSortFunction
xsltElement
xsltElementAvailableFunction
xsltEngineVersion
xsltEvalAVT
xsltEvalAttrValueTemplate
xsltEvalGlobalVariables
xsltEvalOneUserParam
xsltEvalStaticAttrValueTemplate
xsltEvalTemplateString
xsltEvalUserParams
xsltEvalXPathPredicate
xsltEvalXPathString
xsltEvalXPathStringNs
xsltExtElementLookup
xsltExtModuleElementLookup
xsltExtModuleElementPreComputeLookup
xsltExtModuleFunctionLookup
xsltExtModuleTopLevelLookup
xsltExtensionInstructionResultFinalize
xsltExtensionInstructionResultRegister
xsltFindDocument
xsltFindElemSpaceHandling
xsltFindTemplate
xsltFlagRVTs
xsltForEach
xsltFormatNumberConversion
xsltFormatNumberFunction
xsltFreeAVTList
xsltFreeAttributeSetsHashes
xsltFreeCompMatchList
xsltFreeCtxtExts
xsltFreeDocumentKeys
xsltFreeDocuments
xsltFreeExts
xsltFreeGlobalVariables
xsltFreeKeys
xsltFreeLocale
xsltFreeLocales
xsltFreeNamespaceAliasHashes
xsltFreeRVTs
xsltFreeSecurityPrefs
xsltFreeStackElemList
xsltFreeStyleDocuments
xsltFreeStylePreComps
xsltFreeStylesheet
xsltFreeTemplateHashes
xsltFreeTransformContext
xsltFunctionAvailableFunction
xsltFunctionNodeSet
xsltGenerateIdFunction
xsltGenericDebug
xsltGenericDebugContext
xsltGenericError
xsltGenericErrorContext
xsltGetCNsProp
xsltGetDebuggerStatus
xsltGetDefaultSecurityPrefs
xsltGetExtData
xsltGetExtInfo
xsltGetKey
xsltGetNamespace
xsltGetNsProp
xsltGetPlainNamespace
xsltGetQNameURI
xsltGetQNameURI2
xsltGetSecurityPrefs
xsltGetSpecialNamespace
xsltGetTemplate
xsltGetUTF8Char
xsltGetXIncludeDefault
xsltIf
xsltInit
xsltInitAllDocKeys
xsltInitCtxtExts
xsltInitCtxtKey
xsltInitCtxtKeys
xsltInitElemPreComp
xsltInitGlobals
xsltIsBlank
xsltKeyFunction
xsltLibxmlVersion
xsltLibxsltVersion
xsltLoadDocument
xsltLoadStyleDocument
xsltLoadStylesheetPI
xsltLocalVariablePop
xsltLocalVariablePush
xsltLocaleStrcmp
xsltMaxDepth
xsltMaxVars
xsltMessage
xsltNamespaceAlias
xsltNeedElemSpaceHandling
xsltNewDocument
xsltNewElemPreComp
xsltNewLocale
xsltNewSecurityPrefs
xsltNewStyleDocument
xsltNewStylesheet
xsltNewTransformContext
xsltNextImport
xsltNormalizeCompSteps
xsltNumber
xsltNumberFormat
xsltParseGlobalParam
xsltParseGlobalVariable
xsltParseStylesheetAttributeSet
xsltParseStylesheetCallerParam
xsltParseStylesheetDoc
xsltParseStylesheetFile
xsltParseStylesheetImport
xsltParseStylesheetImportedDoc
xsltParseStylesheetInclude
xsltParseStylesheetOutput
xsltParseStylesheetParam
xsltParseStylesheetProcess
xsltParseStylesheetUser
xsltParseStylesheetVariable
xsltParseTemplateContent
xsltPreComputeExtModuleElement
xsltPrintErrorContext
xsltProcessOneNode
xsltProcessingInstruction
xsltProfileStylesheet
xsltQuoteOneUserParam
xsltQuoteUserParams
xsltRegisterAllElement
xsltRegisterAllExtras
xsltRegisterAllFunctions
xsltRegisterExtElement
xsltRegisterExtFunction
xsltRegisterExtModule
xsltRegisterExtModuleElement
xsltRegisterExtModuleFull
xsltRegisterExtModuleFunction
xsltRegisterExtModuleTopLevel
xsltRegisterExtPrefix
xsltRegisterExtras
xsltRegisterLocalRVT
xsltRegisterPersistRVT
xsltRegisterTestModule
xsltRegisterTmpRVT
xsltReleaseRVT
xsltResolveStylesheetAttributeSet
xsltRunStylesheet
xsltRunStylesheetUser
xsltSaveResultTo
xsltSaveResultToFd
xsltSaveResultToFile
xsltSaveResultToFilename
xsltSaveResultToString
xsltSecurityAllow
xsltSecurityForbid
xsltSetCtxtParseOptions
xsltSetCtxtSecurityPrefs
xsltSetCtxtSortFunc
xsltSetDefaultSecurityPrefs
xsltSetGenericDebugFunc
xsltSetGenericErrorFunc
xsltSetLoaderFunc
xsltSetSecurityPrefs
xsltSetSortFunc
xsltSetTransformErrorFunc
xsltSetXIncludeDefault
xsltShutdownCtxtExts
xsltShutdownExts
xsltSort
xsltSplitQName
xsltStrxfrm
xsltStyleGetExtData
xsltStylePreCompute
xsltSystemPropertyFunction
xsltTemplateProcess
xsltTestCompMatchList
xsltText
xsltTransformError
xsltUninit
xsltUnparsedEntityURIFunction
xsltUnregisterExtModule
xsltUnregisterExtModuleElement
xsltUnregisterExtModuleFunction
xsltUnregisterExtModuleTopLevel
xsltValueOf
xsltVariableLookup
xsltXPathCompile
xsltXPathCompileFlags
xsltXPathFunctionLookup
xsltXPathGetTransformContext
xsltXPathVariableLookup

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3096cbe65bfb0015f7e13209a1189445

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:beCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

50:bb:bb:82:e8:d3:64:1e:07:9f:d1:cf:54:03:78:d5:af:60:53:70:ab:0f:a7:5a:54:ca:37:7e:5a:1d:e8:c8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libxml2-v8

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 140KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 776B

.reloc Size: 512B - Virtual size: 128B

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

50:bb:bb:82:e8:d3:64:1e:07:9f:d1:cf:54:03:78:d5:af:60:53:70:ab:0f:a7:5a:54:ca:37:7e:5a:1d:e8:c8
Signer

.text
Size: 140KB - Virtual size: 140KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 512B - Virtual size: 128B