IM_MOD_RL_svg_[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

IM_MOD_RL_svg_.dll
Size

80KB
MD5

37a94581c98171ded14e12c62bf38513
SHA1

6d7c9e452503aea6118e3e29b6688b5e65b44a67
SHA256

fbbd1a53c7a1c9db793c75a01de2487f7f4d9eb95a80485318433214ef7d8b52
SHA512

1dc3b95f1a9ad6e88ddb5d6769648d5b9de8b3b436fae6358feea5d6f852f69e0028922c3b5d3b2c7fc1ae7b749e7ea4eb31f3ae34cc40780cc4318e3d790f66
SSDEEP

1536:6Q6cjNAoN11rF1dJ8ZZyWdSZ2XNwuncWjdF0wdxQ5:63sNAaX1U5eQTcWxW

Score

1^/10

Malware Config

Signatures

Files

IM_MOD_RL_svg_.dll
.dll windows:5 windows x64 arch:x64

8f6439c6c216d15b5a7ec06dbc41e741

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/04/2021, 00:00

Not After

01/05/2024, 23:59

Subject

CN=LLC 1C-Soft,OU=LLC 1C-Soft,O=LLC 1C-Soft,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:3d:8c:64:d6:ec:54:31:a8:9c:94:95:01:79:67:f3:bf:f6:82:8a:c4:41:83:42:5c:2c:7f:76:d1:13:c6:cb
Signer

Actual PE Digest

7f:3d:8c:64:d6:ec:54:31:a8:9c:94:95:01:79:67:f3:bf:f6:82:8a:c4:41:83:42:5c:2c:7f:76:d1:13:c6:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

core_rl_magickcore_

GetExceptionMessage
ThrowMagickException
GetGeometry
ParseGeometry
GetPixelInfo
ImageToBlob
InterpretLocaleValue
LocaleCompare
LocaleNCompare
FormatLocaleFile
FormatLocaleString
SetImageProgress
AcquireString
CloneString
ConstantString
DestroyString
EscapeString
ConcatenateString
IsStringTrue
CopyMagickString
AcquireImage
CloneImage
DestroyImage
AcquireImageInfo
CloneImageInfo
DestroyImageInfo
SetImageBackgroundColor
SetImageExtent
SetImageInfoBlob
GetAffineMatrix
GetImageArtifact
GetDelegateCommands
GetDelegateInfo
ExternalDelegateCommand
AcquireVirtualMemory
RelinquishVirtualMemory
AcquireMagickMemory
AcquireCriticalMemory
AcquireQuantumMemory
GetVirtualMemoryBlob
RelinquishMagickMemory
ResizeQuantumMemory
CloseBlob
OpenBlob
ReadBlob
WriteBlobByte
WriteBlobString
SyncAuthenticPixels
GetAuthenticPixels
ReadImage
WriteImage
ExpandAffine
IsEventLogging
LogMagickEvent
RegisterMagickInfo
UnregisterMagickInfo
AcquireMagickInfo
DestroyImageList
GetFirstImageInList
GetNextImageInList
GetImageOption
IsRightsAuthorized
SetImageProperty
AcquireUniqueFileResource
RelinquishUniqueFileResource
GetNextToken
Base64Encode
AcquireUniqueFilename
AcquireUniqueSymbolicLink

core_rl_cairo_

cairo_create
cairo_destroy
cairo_set_operator
cairo_scale
cairo_paint
cairo_surface_destroy
cairo_surface_status
cairo_format_stride_for_width
cairo_image_surface_create_for_data

core_rl_glib_

g_object_unref
g_error_free

core_rl_libxml_

xmlAddChild
xmlTextConcat
xmlFreeNode
xmlAddNotationDecl
xmlAddElementDecl
xmlAddAttributeDecl
xmlAddDocEntity
xmlGetLastChild
xmlGetDocEntity
xmlGetParameterEntity
xmlDetectCharEncoding
xmlInitParser
xmlSubstituteEntitiesDefault
xmlStopParser
xmlFreeParserCtxt
xmlCreatePushParserCtxt
xmlParseChunk
xmlLoadExternalEntity
xmlCtxtUseOptions
xmlSwitchEncoding
xmlPushInput
xmlPopInput
xmlFreeInputStream
xmlSplitQName
xmlParseExternalSubset
xmlMalloc
xmlFree
xmlNewReference
xmlNewCharRef
xmlNewCDataBlock
xmlFreeDoc
xmlNewDoc
xmlNewDtd
xmlCreateIntSubset
xmlStrdup
xmlAddDtdEntity

core_rl_librsvg_

rsvg_handle_render_cairo
rsvg_handle_new_with_flags
rsvg_handle_get_dimensions
rsvg_handle_set_base_uri
rsvg_handle_close
rsvg_handle_write
rsvg_handle_new
rsvg_handle_set_dpi_x_y

vcruntime140

__C_specific_handler
memset
strchr
__std_type_info_destroy_list
memmove

api-ms-win-crt-stdio-l1-1-0

fclose
__stdio_common_vsscanf
__stdio_common_vsprintf
fputc

api-ms-win-crt-math-l1-1-0

_hypot
_fdopen
_isnan
tan
atan2
ceil
cos
floor
fmod
sqrt
sin

api-ms-win-crt-runtime-l1-1-0

_initterm
_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

isspace
isalpha

api-ms-win-crt-filesystem-l1-1-0

_stat64

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
RtlCaptureContext

Exports

Exports

RegisterSVGImage
UnregisterSVGImage

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f6439c6c216d15b5a7ec06dbc41e741

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:beCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

7f:3d:8c:64:d6:ec:54:31:a8:9c:94:95:01:79:67:f3:bf:f6:82:8a:c4:41:83:42:5c:2c:7f:76:d1:13:c6:cbSigner

Headers

DLL Characteristics

File Characteristics

Imports

core_rl_magickcore_

core_rl_cairo_

core_rl_glib_

core_rl_libxml_

core_rl_librsvg_

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 820B

.reloc Size: 512B - Virtual size: 32B

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

7f:3d:8c:64:d6:ec:54:31:a8:9c:94:95:01:79:67:f3:bf:f6:82:8a:c4:41:83:42:5c:2c:7f:76:d1:13:c6:cb
Signer

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 820B

.reloc
Size: 512B - Virtual size: 32B