CORE_RL_TIFF_[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

CORE_RL_TIFF_.dll
Size

420KB
MD5

c105f4f285dbce371b0c3411d8ccf957
SHA1

2848e70b286592a509a55babf2cb36f74fe386fc
SHA256

82ec12c36f9749fadfe441e89962e596e419862dbac17b1762b567028df0574f
SHA512

f418101ef171a61b1a7c0ab81ddddffa2116a502167ae11aaeb22a1068ed300bc249167426de5330d2f08f28ad131b0f614d6cccbcb8f70a7946e37a83e6270e
SSDEEP

6144:1q5m4GAc4ohttttttVd6k9EAwQMXpTlniaqpPGcz9H+6S9ayQgV:1q84GK7jAwziav6YZ

Score

1^/10

Malware Config

Signatures

Files

CORE_RL_TIFF_.dll
.dll windows:5 windows x64 arch:x64

93fc2b845a641724e6873b5394462df0

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26-04-2021 00:00

Not After

01-05-2024 23:59

Subject

CN=LLC 1C-Soft,OU=LLC 1C-Soft,O=LLC 1C-Soft,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:76:79:3b:7a:88:d2:ad:ce:9c:52:3b:bf:10:f0:2c:4b:bb:d2:e7:ff:62:e5:5d:45:4e:18:1b:2f:b2:7c:66
Signer

Actual PE Digest

9e:76:79:3b:7a:88:d2:ad:ce:9c:52:3b:bf:10:f0:2c:4b:bb:d2:e7:ff:62:e5:5d:45:4e:18:1b:2f:b2:7c:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

core_rl_jpeg_

jpeg_finish_decompress
jpeg_resync_to_restart
jpeg_std_error
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_set_defaults
jpeg_set_colorspace
jpeg_set_quality
jpeg_suppress_tables
jpeg_start_compress
jpeg_write_scanlines
jpeg_finish_compress
jpeg_write_raw_data
jpeg_write_tables
jpeg_read_header
jpeg_start_decompress
jpeg_read_scanlines
jpeg_destroy
jpeg_read_raw_data
jpeg_has_multiple_scans
jpeg_abort

core_rl_zlib_

inflateInit_
deflate
deflateEnd
inflate
inflateEnd
deflateReset
deflateParams
inflateReset
deflateInit_

vcruntime140

__std_type_info_destroy_list
strchr
memcpy
longjmp
__C_specific_handler
memset
__intrinsic_setjmp
memmove
memcmp

api-ms-win-crt-math-l1-1-0

sqrt
pow
floor
atan2
exp
log

api-ms-win-crt-string-l1-1-0

strcmp
isprint
strncmp

api-ms-win-crt-stdio-l1-1-0

_close
fputc
_write
fputs
_wopen
__stdio_common_vsprintf
_lseeki64
_read
_open
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort
rand
bsearch

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
strerror
_errno
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
calloc

api-ms-win-crt-filesystem-l1-1-0

_fstat64

Exports

Exports

TIFFAccessTagMethods
TIFFCIELabToRGBInit
TIFFCIELabToXYZ
TIFFCheckTile
TIFFCheckpointDirectory
TIFFCleanup
TIFFClientOpen
TIFFClientdata
TIFFClose
TIFFComputeStrip
TIFFComputeTile
TIFFCreateCustomDirectory
TIFFCreateDirectory
TIFFCreateEXIFDirectory
TIFFCreateGPSDirectory
TIFFCurrentDirOffset
TIFFCurrentDirectory
TIFFCurrentRow
TIFFCurrentStrip
TIFFCurrentTile
TIFFDataWidth
TIFFDefaultStripSize
TIFFDefaultTileSize
TIFFDeferStrileArrayWriting
TIFFError
TIFFErrorExt
TIFFFdOpen
TIFFFieldDataType
TIFFFieldName
TIFFFieldPassCount
TIFFFieldReadCount
TIFFFieldTag
TIFFFieldWithName
TIFFFieldWithTag
TIFFFieldWriteCount
TIFFFileName
TIFFFileno
TIFFFindCODEC
TIFFFindField
TIFFFlush
TIFFFlushData
TIFFForceStrileArrayWriting
TIFFFreeDirectory
TIFFGetBitRevTable
TIFFGetClientInfo
TIFFGetCloseProc
TIFFGetConfiguredCODECs
TIFFGetField
TIFFGetFieldDefaulted
TIFFGetMapFileProc
TIFFGetMode
TIFFGetReadProc
TIFFGetSeekProc
TIFFGetSizeProc
TIFFGetStrileByteCount
TIFFGetStrileByteCountWithErr
TIFFGetStrileOffset
TIFFGetStrileOffsetWithErr
TIFFGetTagListCount
TIFFGetTagListEntry
TIFFGetUnmapFileProc
TIFFGetVersion
TIFFGetWriteProc
TIFFIsBigEndian
TIFFIsByteSwapped
TIFFIsCODECConfigured
TIFFIsMSB2LSB
TIFFIsTiled
TIFFIsUpSampled
TIFFLastDirectory
TIFFMergeFieldInfo
TIFFNumberOfDirectories
TIFFNumberOfStrips
TIFFNumberOfTiles
TIFFOpen
TIFFOpenW
TIFFPrintDirectory
TIFFRGBAImageBegin
TIFFRGBAImageEnd
TIFFRGBAImageGet
TIFFRGBAImageOK
TIFFRasterScanlineSize
TIFFRasterScanlineSize64
TIFFRawStripSize
TIFFRawStripSize64
TIFFReadBufferSetup
TIFFReadCustomDirectory
TIFFReadDirectory
TIFFReadEXIFDirectory
TIFFReadEncodedStrip
TIFFReadEncodedTile
TIFFReadFromUserBuffer
TIFFReadGPSDirectory
TIFFReadRGBAImage
TIFFReadRGBAImageOriented
TIFFReadRGBAStrip
TIFFReadRGBAStripExt
TIFFReadRGBATile
TIFFReadRGBATileExt
TIFFReadRawStrip
TIFFReadRawTile
TIFFReadScanline
TIFFReadTile
TIFFRegisterCODEC
TIFFReverseBits
TIFFRewriteDirectory
TIFFScanlineSize
TIFFScanlineSize64
TIFFSetClientInfo
TIFFSetClientdata
TIFFSetCompressionScheme
TIFFSetDirectory
TIFFSetErrorHandler
TIFFSetErrorHandlerExt
TIFFSetField
TIFFSetFileName
TIFFSetFileno
TIFFSetMode
TIFFSetSubDirectory
TIFFSetTagExtender
TIFFSetWarningHandler
TIFFSetWarningHandlerExt
TIFFSetWriteOffset
TIFFSetupStrips
TIFFStripSize
TIFFStripSize64
TIFFSwabArrayOfDouble
TIFFSwabArrayOfFloat
TIFFSwabArrayOfLong
TIFFSwabArrayOfLong8
TIFFSwabArrayOfShort
TIFFSwabArrayOfTriples
TIFFSwabDouble
TIFFSwabFloat
TIFFSwabLong
TIFFSwabLong8
TIFFSwabShort
TIFFTileRowSize
TIFFTileRowSize64
TIFFTileSize
TIFFTileSize64
TIFFUnRegisterCODEC
TIFFUnlinkDirectory
TIFFUnsetField
TIFFVGetField
TIFFVGetFieldDefaulted
TIFFVSetField
TIFFVStripSize
TIFFVStripSize64
TIFFVTileSize
TIFFVTileSize64
TIFFWarning
TIFFWarningExt
TIFFWriteBufferSetup
TIFFWriteCheck
TIFFWriteCustomDirectory
TIFFWriteDirectory
TIFFWriteEncodedStrip
TIFFWriteEncodedTile
TIFFWriteRawStrip
TIFFWriteRawTile
TIFFWriteScanline
TIFFWriteTile
TIFFXYZToRGB
TIFFYCbCrToRGBInit
TIFFYCbCrtoRGB
_TIFFCheckMalloc
_TIFFCheckRealloc
_TIFFGetExifFields
_TIFFGetGpsFields
_TIFFMultiply32
_TIFFMultiply64
_TIFFRewriteField
_TIFFfree
_TIFFmalloc
_TIFFmemcmp
_TIFFmemcpy
_TIFFmemset
_TIFFrealloc

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93fc2b845a641724e6873b5394462df0

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:beCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

9e:76:79:3b:7a:88:d2:ad:ce:9c:52:3b:bf:10:f0:2c:4b:bb:d2:e7:ff:62:e5:5d:45:4e:18:1b:2f:b2:7c:66Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

core_rl_jpeg_

core_rl_zlib_

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 12KB - Virtual size: 11KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 820B

.reloc Size: 1024B - Virtual size: 844B

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

9e:76:79:3b:7a:88:d2:ad:ce:9c:52:3b:bf:10:f0:2c:4b:bb:d2:e7:ff:62:e5:5d:45:4e:18:1b:2f:b2:7c:66
Signer

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 12KB - Virtual size: 11KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 820B

.reloc
Size: 1024B - Virtual size: 844B