CORE_RL_JPEG_[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CORE_RL_JPEG_.dll
Size

535KB
MD5

ab044018e8d205646bdcf70f4d950af3
SHA1

9f60f0b9ae4042876e4efb0d69f141e469c948aa
SHA256

1744261399985aff55bd6ee69e8788c4e4539f91b16074e4c7efb376d169f1e8
SHA512

a4fec4f85e8f2cecf7b084c1a9cd17b329aeceb475e751bf34f8d1c3dadf7aa842fa61a940e95ac8faf0745caaea0812015082606bc250537d207b4526d989ce
SSDEEP

6144:x2k8NMSApjbuylX4ubnCZNrZE/m/wk3MYEZsB7MdOAavEjJ2nY35zQ7:xFSAKX65ZsBnI2izs

Score

1^/10

Malware Config

Signatures

Files

CORE_RL_JPEG_.dll
.dll windows:5 windows x64 arch:x64

3278571119261b017b7d6248cd5acfb3

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/04/2021, 00:00

Not After

01/05/2024, 23:59

Subject

CN=LLC 1C-Soft,OU=LLC 1C-Soft,O=LLC 1C-Soft,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:29:a7:3b:10:d3:50:ce:e1:6d:c9:15:fd:f1:ef:ab:f9:29:15:da:b0:3b:84:1e:80:31:a4:0e:82:95:47:b2
Signer

Actual PE Digest

0b:29:a7:3b:10:d3:50:ce:e1:6d:c9:15:fd:f1:ef:ab:f9:29:15:da:b0:3b:84:1e:80:31:a4:0e:82:95:47:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

vcruntime140

__C_specific_handler
memcpy
__std_type_info_destroy_list
memset

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vfprintf
__acrt_iob_func
fread
fwrite
fflush
ferror
__stdio_common_vsscanf

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_execute_onexit_table
_register_onexit_function
_cexit
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
exit
_initialize_onexit_table
_crt_atexit

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

isdigit

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
RtlCaptureContext

Exports

Exports

jcopy_block_row
jcopy_markers_execute
jcopy_markers_setup
jcopy_sample_rows
jdiv_round_up
jinit_1pass_quantizer
jinit_2pass_quantizer
jinit_arith_decoder
jinit_arith_encoder
jinit_c_coef_controller
jinit_c_main_controller
jinit_c_master_control
jinit_c_prep_controller
jinit_color_converter
jinit_color_deconverter
jinit_compress_master
jinit_d_coef_controller
jinit_d_main_controller
jinit_d_post_controller
jinit_downsampler
jinit_forward_dct
jinit_huff_decoder
jinit_huff_encoder
jinit_input_controller
jinit_inverse_dct
jinit_marker_reader
jinit_marker_writer
jinit_master_decompress
jinit_memory_mgr
jinit_merged_upsampler
jinit_phuff_decoder
jinit_phuff_encoder
jinit_upsampler
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort
jpeg_abort_compress
jpeg_abort_decompress
jpeg_add_quant_table
jpeg_alloc_huff_table
jpeg_alloc_quant_table
jpeg_calc_output_dimensions
jpeg_consume_input
jpeg_copy_critical_parameters
jpeg_crop_scanline
jpeg_default_colorspace
jpeg_destroy
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_fdct_float
jpeg_fdct_ifast
jpeg_fdct_islow
jpeg_fill_bit_buffer
jpeg_finish_compress
jpeg_finish_decompress
jpeg_finish_output
jpeg_free_large
jpeg_free_small
jpeg_gen_optimal_table
jpeg_get_large
jpeg_get_small
jpeg_has_multiple_scans
jpeg_huff_decode
jpeg_idct_10x10
jpeg_idct_11x11
jpeg_idct_12x12
jpeg_idct_13x13
jpeg_idct_14x14
jpeg_idct_15x15
jpeg_idct_16x16
jpeg_idct_1x1
jpeg_idct_2x2
jpeg_idct_3x3
jpeg_idct_4x4
jpeg_idct_5x5
jpeg_idct_6x6
jpeg_idct_7x7
jpeg_idct_9x9
jpeg_idct_float
jpeg_idct_ifast
jpeg_idct_islow
jpeg_input_complete
jpeg_make_c_derived_tbl
jpeg_make_d_derived_tbl
jpeg_mem_available
jpeg_mem_dest
jpeg_mem_init
jpeg_mem_src
jpeg_mem_term
jpeg_new_colormap
jpeg_open_backing_store
jpeg_quality_scaling
jpeg_read_coefficients
jpeg_read_header
jpeg_read_icc_profile
jpeg_read_raw_data
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_save_markers
jpeg_set_colorspace
jpeg_set_defaults
jpeg_set_linear_quality
jpeg_set_marker_processor
jpeg_set_quality
jpeg_simple_progression
jpeg_skip_scanlines
jpeg_start_compress
jpeg_start_decompress
jpeg_start_output
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_suppress_tables
jpeg_write_coefficients
jpeg_write_icc_profile
jpeg_write_m_byte
jpeg_write_m_header
jpeg_write_marker
jpeg_write_raw_data
jpeg_write_scanlines
jpeg_write_tables
jround_up
jsimd_can_convsamp
jsimd_can_convsamp_float
jsimd_can_encode_mcu_AC_first_prepare
jsimd_can_encode_mcu_AC_refine_prepare
jsimd_can_fdct_float
jsimd_can_fdct_ifast
jsimd_can_fdct_islow
jsimd_can_h2v1_downsample
jsimd_can_h2v1_fancy_upsample
jsimd_can_h2v1_merged_upsample
jsimd_can_h2v1_upsample
jsimd_can_h2v2_downsample
jsimd_can_h2v2_fancy_upsample
jsimd_can_h2v2_merged_upsample
jsimd_can_h2v2_upsample
jsimd_can_huff_encode_one_block
jsimd_can_idct_2x2
jsimd_can_idct_4x4
jsimd_can_idct_float
jsimd_can_idct_ifast
jsimd_can_idct_islow
jsimd_can_quantize
jsimd_can_quantize_float
jsimd_can_rgb_gray
jsimd_can_rgb_ycc
jsimd_can_ycc_rgb
jsimd_can_ycc_rgb565
jsimd_convsamp
jsimd_convsamp_float
jsimd_encode_mcu_AC_first_prepare
jsimd_encode_mcu_AC_refine_prepare
jsimd_fdct_float
jsimd_fdct_ifast
jsimd_fdct_islow
jsimd_h2v1_downsample
jsimd_h2v1_fancy_upsample
jsimd_h2v1_merged_upsample
jsimd_h2v1_upsample
jsimd_h2v2_downsample
jsimd_h2v2_fancy_upsample
jsimd_h2v2_merged_upsample
jsimd_h2v2_upsample
jsimd_huff_encode_one_block
jsimd_idct_2x2
jsimd_idct_4x4
jsimd_idct_float
jsimd_idct_ifast
jsimd_idct_islow
jsimd_quantize
jsimd_quantize_float
jsimd_rgb_gray_convert
jsimd_rgb_ycc_convert
jsimd_ycc_rgb565_convert
jsimd_ycc_rgb_convert
jtransform_adjust_parameters
jtransform_execute_transform
jtransform_parse_crop_spec
jtransform_perfect_transform
jtransform_request_workspace
jzero_far

Sections

.text
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3278571119261b017b7d6248cd5acfb3

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:beCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0b:29:a7:3b:10:d3:50:ce:e1:6d:c9:15:fd:f1:ef:ab:f9:29:15:da:b0:3b:84:1e:80:31:a4:0e:82:95:47:b2Signer

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 286KB - Virtual size: 285KB

.rdata Size: 226KB - Virtual size: 225KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 9KB - Virtual size: 9KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 296B

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0b:29:a7:3b:10:d3:50:ce:e1:6d:c9:15:fd:f1:ef:ab:f9:29:15:da:b0:3b:84:1e:80:31:a4:0e:82:95:47:b2
Signer

.text
Size: 286KB - Virtual size: 285KB

.rdata
Size: 226KB - Virtual size: 225KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 9KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 296B