CORE_RL_JP2_[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CORE_RL_JP2_.dll
Size

230KB
MD5

01e03f56c30ebd87950c0ee9bb6b07c5
SHA1

cd4729ec009f29f63839197efa6444cd72a9f2ca
SHA256

f487d1c009ad0f3bcd05b00fccac9fa9a7ba71c4580fe29c589bda63be26b6cb
SHA512

ab8ffe7098dd7fe1d1a829d94a7ddfe88c256fba3f3fae6cd7a4f9606e6b0f8300aa8fffa2770e6ace8005aefd93d92f0b697b503e576515b0aca440dca0724d
SSDEEP

6144:FDgsbES7/ESEs6e1Vn4KLxU1JEWZEDbel:FDggh7ry+4KLxVW0bel

Score

1^/10

Malware Config

Signatures

Files

CORE_RL_JP2_.dll
.dll windows:5 windows x64 arch:x64

f90c9ff8e230f6e1e4ab0c4bdfdf9052

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/04/2021, 00:00

Not After

01/05/2024, 23:59

Subject

CN=LLC 1C-Soft,OU=LLC 1C-Soft,O=LLC 1C-Soft,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:f4:e4:71:bb:0b:27:74:e1:1d:56:be:e2:8e:c3:17:fe:3a:2e:8c:27:7b:c9:4f:6d:41:92:7a:fa:c1:73:96
Signer

Actual PE Digest

25:f4:e4:71:bb:0b:27:74:e1:1d:56:be:e2:8e:c3:17:fe:3a:2e:8c:27:7b:c9:4f:6d:41:92:7a:fa:c1:73:96

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

vcruntime140

__C_specific_handler
strchr
memcpy
strrchr
memset
__std_type_info_destroy_list
memmove

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
abort
_seh_filter_dll
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

floor
pow
sqrt
ceil

api-ms-win-crt-stdio-l1-1-0

_read
_setmode
_write
_lseek
_close
__acrt_iob_func
__stdio_common_vfprintf
ferror
tmpnam
fwrite
feof
fclose
__stdio_common_vsprintf
fseek
fread
_open
fputc

api-ms-win-crt-string-l1-1-0

isdigit
isalpha
isprint
strtok
strncpy
isspace

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc

api-ms-win-crt-convert-l1-1-0

atoi
atof
strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlink

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
RtlCaptureContext

Exports

Exports

jas_alloc2
jas_alloc3
jas_calloc
jas_cleanup
jas_cmprof_copy
jas_cmprof_createfromclrspc
jas_cmprof_createfromiccprof
jas_cmprof_destroy
jas_eprintf
jas_free
jas_getdbglevel
jas_getopt
jas_getversion
jas_iccattrtab_dump
jas_iccattrval_allowmodify
jas_iccattrval_clone
jas_iccattrval_create
jas_iccattrval_destroy
jas_iccattrval_dump
jas_iccprof_copy
jas_iccprof_createfrombuf
jas_iccprof_createfromclrspc
jas_iccprof_createfromcmprof
jas_iccprof_destroy
jas_iccprof_dump
jas_iccprof_getattr
jas_iccprof_gethdr
jas_iccprof_load
jas_iccprof_save
jas_iccprof_setattr
jas_iccprof_sethdr
jas_image_addcmpt
jas_image_addfmt
jas_image_chclrspc
jas_image_clearfmts
jas_image_cmpt_domains_same
jas_image_copy
jas_image_copycmpt
jas_image_create
jas_image_create0
jas_image_decode
jas_image_delcmpt
jas_image_depalettize
jas_image_destroy
jas_image_encode
jas_image_fmtfromname
jas_image_fmttostr
jas_image_getcmptbytype
jas_image_getfmt
jas_image_lookupfmtbyid
jas_image_lookupfmtbyname
jas_image_rawsize
jas_image_readcmpt
jas_image_readcmptsample
jas_image_strtofmt
jas_image_writecmpt
jas_image_writecmptsample
jas_init
jas_malloc
jas_matrix_asl
jas_matrix_asr
jas_matrix_bindsub
jas_matrix_clip
jas_matrix_cmp
jas_matrix_copy
jas_matrix_create
jas_matrix_destroy
jas_matrix_divpow2
jas_matrix_resize
jas_matrix_setall
jas_optarg
jas_opterr
jas_optind
jas_realloc
jas_realloc2
jas_seq2d_bindsub
jas_seq2d_copy
jas_seq2d_create
jas_setdbglevel
jas_strdup
jas_stream_close
jas_stream_copy
jas_stream_display
jas_stream_fdopen
jas_stream_fillbuf
jas_stream_flush
jas_stream_flushbuf
jas_stream_fopen
jas_stream_freopen
jas_stream_getc_func
jas_stream_gets
jas_stream_gobble
jas_stream_isseekable
jas_stream_length
jas_stream_memopen
jas_stream_memopen2
jas_stream_pad
jas_stream_printf
jas_stream_putc_func
jas_stream_puts
jas_stream_read
jas_stream_rewind
jas_stream_seek
jas_stream_setrwcount
jas_stream_tell
jas_stream_tmpfile
jas_stream_ungetc
jas_stream_write
jas_taginfo_nonull
jas_taginfos_lookup
jas_tmr_get
jas_tmr_start
jas_tmr_stop
jas_tvparser_create
jas_tvparser_destroy
jas_tvparser_gettag
jas_tvparser_getval
jas_tvparser_next

Sections

.text
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f90c9ff8e230f6e1e4ab0c4bdfdf9052

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:beCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

25:f4:e4:71:bb:0b:27:74:e1:1d:56:be:e2:8e:c3:17:fe:3a:2e:8c:27:7b:c9:4f:6d:41:92:7a:fa:c1:73:96Signer

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 166KB - Virtual size: 166KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 11KB - Virtual size: 38KB

.pdata Size: 10KB - Virtual size: 10KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 900B

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

25:f4:e4:71:bb:0b:27:74:e1:1d:56:be:e2:8e:c3:17:fe:3a:2e:8c:27:7b:c9:4f:6d:41:92:7a:fa:c1:73:96
Signer

.text
Size: 166KB - Virtual size: 166KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 11KB - Virtual size: 38KB

.pdata
Size: 10KB - Virtual size: 10KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 900B