clrcompression[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

clrcompression.dll
Size

703KB
MD5

9b2fe433ec8477ccc39531fe0459cb2d
SHA1

250d13daaa4a7e5be4eb361cf71aa2770fd5cb59
SHA256

9f4de5060999a97219bdf9ddf583666e7ac523163f14a99c8e6839e6daad39f0
SHA512

96242fc3972a8b2b7fcb364dcefdf4d324103c58d088345f3cb1b3d3b8574e318ed33a1c04416a307064c8090dd73d5add79b7100f032e9553dc213c0e2c1fec
SSDEEP

12288:LU7xzH286S2bES2e8zIpPK6TMqaxTZHqAHhlyHMD8UXTw05nmZfRSP:LUdzH286S2bES2RsK2YThqA0TfAmZfRQ

Score

1^/10

Malware Config

Signatures

Files

clrcompression.dll
.dll windows:6 windows x86 arch:x86

1dc31de28c38c94cf081a786f0ef0ce1

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:27:1f:db:c8:0a:12:44:04:3a:f0:41:2d:ef:1d:06:28:f8:cb:27:c7:d6:72:ba:18:4c:94:10:65:df:74:07
Signer

Actual PE Digest

f0:27:1f:db:c8:0a:12:44:04:3a:f0:41:2d:ef:1d:06:28:f8:cb:27:c7:d6:72:ba:18:4c:94:10:65:df:74:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\artifacts\obj\native\netcoreapp-Windows_NT-Release-x86\clrcompression\Release\clrcompression.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-math-l1-1-0

log2
_except1

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_cexit
_configure_narrow_argv
exit
_initialize_narrow_environment
_seh_filter_dll
terminate
_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

wcsncmp

Exports

Exports

BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliSetDictionaryData
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dc31de28c38c94cf081a786f0ef0ce1

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

f0:27:1f:db:c8:0a:12:44:04:3a:f0:41:2d:ef:1d:06:28:f8:cb:27:c7:d6:72:ba:18:4c:94:10:65:df:74:07Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 248KB - Virtual size: 247KB

.rdata Size: 439KB - Virtual size: 438KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

f0:27:1f:db:c8:0a:12:44:04:3a:f0:41:2d:ef:1d:06:28:f8:cb:27:c7:d6:72:ba:18:4c:94:10:65:df:74:07
Signer

.text
Size: 248KB - Virtual size: 247KB

.rdata
Size: 439KB - Virtual size: 438KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB