cab55a3f1eb3d0867f6dff4e7801eedd23aaaa22cb08ba0a60a117389b3a348c

Sharing

Copy URL Twitter E-mail

General

Target

cab55a3f1eb3d0867f6dff4e7801eedd23aaaa22cb08ba0a60a117389b3a348c
Size

350KB
MD5

9f7bcd3de3b00fc03e769dc57bc80e80
SHA1

c3651145e382c8f116e00aca2164a9da0eb3517b
SHA256

cab55a3f1eb3d0867f6dff4e7801eedd23aaaa22cb08ba0a60a117389b3a348c
SHA512

cb31cfcd8ff81dc855493f013fbfc43c88c601a96a14e7a597ee8aee5fc0198c8837d5f85b68b37f3bb61e89de463bab1656a4f9fae790c5bff990ea8b8469e7
SSDEEP

6144:74xjGD+uEDga883N0DxFNWQe94RT2mJG/1maxfJnwZohXQ5lUG+e5XX9:sxjGJEDl8CNAxFA/94AjpwZo1oht

Score

1^/10

Malware Config

Signatures

Files

cab55a3f1eb3d0867f6dff4e7801eedd23aaaa22cb08ba0a60a117389b3a348c
.dll windows:6 windows x64 arch:x64

37027909811ef440d4ab6bfcaf0c3894

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

06/09/2023, 06:47

Not After

06/09/2026, 06:47

Subject

SERIALNUMBER=91110108766259016Q,CN=DVDFab Software Inc.,O=DVDFab Software Inc.,STREET=海淀区北四环西路9号2108,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b3:64:74:43:d9:67:34:ad:01:26:2d:30:f5:3d:94:a2:53:a8:1f:92
Signer

Actual PE Digest

b3:64:74:43:d9:67:34:ad:01:26:2d:30:f5:3d:94:a2:53:a8:1f:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libxml2

xmlFreeDtd
xmlNewNsProp
xmlNewDocNodeEatName
xmlNewDocText
xmlNewDocPI
xmlNewTextLen
xmlNewComment
xmlNewCDataBlock
xmlIsBlankNode
xmlGetNsList
xmlNodeAddContent
xmlXPathNodeSetCreate
xmlXPathFreeNodeSet
xmlXPathCastToString
xmlXPathContextSetCache
xmlXPathOrderDocElems
xmlXPathCompiledEvalToBoolean
xmlXPathInit
xmlXPathRegisterVariableLookup
xmlXPathRegisterFuncLookup
xmlXPathNodeSetAddUnique
htmlNewDoc
htmlNewDocNoDtD
xmlURIEscapeStr
xmlStringText
xmlStrchr
xmlStrcat
xmlStrncat
xmlNewDocProp
xmlNodeGetContent
xmlXPathEvalPredicate
xmlParserGetDirectory
xmlCreateURI
xmlStrncasecmp
xmlHashAddEntry3
xmlHashUpdateEntry3
xmlHashLookup3
xmlCharInRange
xmlStringCurrentChar
xmlXPathEval
xmlXPathIsNodeType
xmlIsBaseCharGroup
xmlIsCombiningGroup
xmlIsDigitGroup
xmlIsExtenderGroup
xmlStrncmp
xmlUTF8Strpos
xmlUTF8Strloc
xmlGetIntSubset
xmlBufferFree
xmlBufferAdd
xmlBufferCat
xmlBufferCCat
xmlBufferContent
xmlCopyCharMultiByte
xmlXPathEvalExpression
xmlXPathIsInf
xmlXPathNewParserContext
xmlXPathFreeParserContext
xmlXPathNextAncestor
xmlXPathNextPrecedingSibling
xmlHashAddEntry
xmlXPathCastNodeToString
xmlXPathNodeSetAdd
xmlSplitQName2
xmlGetDocEntity
xmlXPathErr
xmlXPathNsLookup
xmlXPathRegisterFunc
xmlXPathFunctionLookupNS
valuePop
valuePush
xmlXPathNewBoolean
xmlXPathNewNodeSet
xmlXPathNodeSetMerge
xmlXPathWrapNodeSet
xmlXPathStringFunction
xmlXPathNumberFunction
xmlSaveUri
xmlXPtrNewContext
xmlXPtrEval
xmlXPathDebugDumpObject
xmlHashUpdateEntry2
xmlHashRemoveEntry
xmlNewMutex
xmlMutexLock
xmlMutexUnlock
xmlFreeMutex
xmlXPathRegisterFuncNS
xmlParseDocument
xmlNewParserCtxt
xmlFreeParserCtxt
xmlLoadExternalEntity
xmlCtxtUseOptions
inputPush
xmlXIncludeProcessFlags
xmlCreateIntSubset
xmlDictQLookup
xmlDictCreateSub
xmlStrstr
xmlXPathNewValueTree
xmlXPathNewCString
xmlXPathNewString
xmlXPathFreeCompExpr
xmlXPathCompile
xmlXPathObjectCopy
xmlFreeRefTable
xmlFreeIDTable
xmlHashScan
xmlFreeNodeList
xmlXPathStringEvalNumber
xmlFreeURI
xmlParseURI
xmlBuildURI
xmlFreeRMutex
xmlNewRMutex
__xmlGenericErrorContext
__xmlGenericError
xmlGetID
xmlHashLookup
xmlHashUpdateEntry
xmlNodeGetBase
xmlNodeGetSpacePreserve
xmlNodeSetContent
xmlSearchNsByHref
xmlFreeNode
xmlUnlinkNode
xmlAddPrevSibling
xmlAddChild
xmlDocGetRootElement
xmlDocCopyNode
xmlFreeDoc
xmlNewNs
xmlValidateNCName
xmlDictOwns
xmlDictFree
xmlDictReference
xmlDictCreate
xmlStrcasecmp
xmlRMutexUnlock
xmlRMutexLock
xmlRealloc
xmlXPathIsNaN
xmlXPathCompiledEval
xmlXPathCtxtCompile
xmlXPathFreeContext
xmlXPathNewContext
xmlXPathConvertString
xmlXPathConvertNumber
xmlXPathCmpNodes
xmlXPathFreeObject
htmlDocContentDumpFormatOutput
htmlDocContentDumpOutput
htmlSetMetaEncoding
xmlOutputBufferClose
xmlOutputBufferFlush
xmlOutputBufferWriteString
xmlOutputBufferCreateFd
xmlOutputBufferCreateFile
xmlOutputBufferCreateFilename
xmlAllocOutputBuffer
xmlGetCharEncodingName
xmlFindCharEncodingHandler
xmlGetDtdAttrDesc
xmlNodeDumpOutput
xmlNodeListGetString
xmlGetProp
xmlSetProp
xmlDocSetRootElement
xmlGetLineNo
xmlNewChild
xmlNewDocNode
xmlNewDoc
xmlBufUse
xmlBufContent
xmlStrlen
xmlStrcmp
xmlStrndup
xmlStringTextNoenc
xmlFree
xmlMalloc
xmlIsID
xmlAddID
xmlHashScanFull
xmlHashLookup2
xmlHashRemoveEntry2
xmlHashAddEntry2
xmlHashFree
xmlHashCreate
xmlGetNsProp
xmlSetNsProp
xmlSearchNs
xmlNewText
xmlValidateQName
xmlDictLookup
xmlStrEqual
xmlBufferCreate
xmlStrdup

kernel32

SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
ReadConsoleW
ReadFile
GetStringTypeW
LCMapStringW
HeapSize
OutputDebugStringW
WriteConsoleW
RaiseException
CreateFileW
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
SetStdHandle
SetFilePointerEx
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
HeapReAlloc
HeapAlloc
GetModuleFileNameW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
GetProcessHeap
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
FindClose
CreateDirectoryW
CloseHandle
GetFileType
GetStdHandle
RtlUnwindEx
WideCharToMultiByte
AreFileApisANSI
GetModuleHandleExW
ExitProcess
DecodePointer
EncodePointer
HeapFree
GetLastError
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
IsDebuggerPresent
GetFileAttributesA
EnumSystemLocalesA
GetLocaleInfoA
MultiByteToWideChar
CompareStringW
QueryPerformanceFrequency
QueryPerformanceCounter

Exports

Exports

xslAddCall
xslDebugStatus
xslDropCall
xslHandleDebugger
xsltAddKey
xsltAddStackElemList
xsltAddTemplate
xsltAllocateExtra
xsltAllocateExtraCtxt
xsltApplyAttributeSet
xsltApplyImports
xsltApplyOneTemplate
xsltApplyStripSpaces
xsltApplyStylesheet
xsltApplyStylesheetUser
xsltApplyTemplates
xsltAttrListTemplateProcess
xsltAttrTemplateProcess
xsltAttrTemplateValueProcess
xsltAttrTemplateValueProcessNode
xsltAttribute
xsltCalibrateAdjust
xsltCallTemplate
xsltCheckExtPrefix
xsltCheckExtURI
xsltCheckRead
xsltCheckWrite
xsltChoose
xsltCleanupGlobals
xsltCleanupTemplates
xsltComment
xsltCompileAttr
xsltCompilePattern
xsltComputeSortResult
xsltCopy
xsltCopyNamespace
xsltCopyNamespaceList
xsltCopyOf
xsltCopyTextString
xsltCreateRVT
xsltDebug
xsltDebugDumpExtensions
xsltDebugGetDefaultTrace
xsltDebugSetDefaultTrace
xsltDecimalFormatGetByName
xsltDefaultSortFunction
xsltDoSortFunction
xsltDocDefaultLoader
xsltDocumentComp
xsltDocumentElem
xsltDocumentFunction
xsltDocumentSortFunction
xsltElement
xsltElementAvailableFunction
xsltEngineVersion
xsltEvalAVT
xsltEvalAttrValueTemplate
xsltEvalGlobalVariables
xsltEvalOneUserParam
xsltEvalStaticAttrValueTemplate
xsltEvalTemplateString
xsltEvalUserParams
xsltEvalXPathPredicate
xsltEvalXPathString
xsltEvalXPathStringNs
xsltExtElementLookup
xsltExtModuleElementLookup
xsltExtModuleElementPreComputeLookup
xsltExtModuleFunctionLookup
xsltExtModuleTopLevelLookup
xsltExtensionInstructionResultFinalize
xsltExtensionInstructionResultRegister
xsltFindDocument
xsltFindElemSpaceHandling
xsltFindTemplate
xsltFlagRVTs
xsltForEach
xsltFormatNumberConversion
xsltFormatNumberFunction
xsltFreeAVTList
xsltFreeAttributeSetsHashes
xsltFreeCompMatchList
xsltFreeCtxtExts
xsltFreeDocumentKeys
xsltFreeDocuments
xsltFreeExts
xsltFreeGlobalVariables
xsltFreeKeys
xsltFreeLocale
xsltFreeLocales
xsltFreeNamespaceAliasHashes
xsltFreeRVTs
xsltFreeSecurityPrefs
xsltFreeStackElemList
xsltFreeStyleDocuments
xsltFreeStylePreComps
xsltFreeStylesheet
xsltFreeTemplateHashes
xsltFreeTransformContext
xsltFunctionAvailableFunction
xsltFunctionNodeSet
xsltGenerateIdFunction
xsltGenericDebug
xsltGenericDebugContext
xsltGenericError
xsltGenericErrorContext
xsltGetCNsProp
xsltGetDebuggerStatus
xsltGetDefaultSecurityPrefs
xsltGetExtData
xsltGetExtInfo
xsltGetKey
xsltGetNamespace
xsltGetNsProp
xsltGetPlainNamespace
xsltGetProfileInformation
xsltGetQNameURI
xsltGetQNameURI2
xsltGetSecurityPrefs
xsltGetSpecialNamespace
xsltGetTemplate
xsltGetUTF8Char
xsltGetXIncludeDefault
xsltIf
xsltInit
xsltInitAllDocKeys
xsltInitCtxtExts
xsltInitCtxtKey
xsltInitCtxtKeys
xsltInitElemPreComp
xsltInitGlobals
xsltIsBlank
xsltKeyFunction
xsltLibxmlVersion
xsltLibxsltVersion
xsltLoadDocument
xsltLoadStyleDocument
xsltLoadStylesheetPI
xsltLocalVariablePop
xsltLocalVariablePush
xsltLocaleStrcmp
xsltMaxDepth
xsltMaxVars
xsltMessage
xsltNamespaceAlias
xsltNeedElemSpaceHandling
xsltNewDocument
xsltNewElemPreComp
xsltNewLocale
xsltNewSecurityPrefs
xsltNewStyleDocument
xsltNewStylesheet
xsltNewTransformContext
xsltNextImport
xsltNormalizeCompSteps
xsltNumber
xsltNumberFormat
xsltParseGlobalParam
xsltParseGlobalVariable
xsltParseStylesheetAttributeSet
xsltParseStylesheetCallerParam
xsltParseStylesheetDoc
xsltParseStylesheetFile
xsltParseStylesheetImport
xsltParseStylesheetImportedDoc
xsltParseStylesheetInclude
xsltParseStylesheetOutput
xsltParseStylesheetParam
xsltParseStylesheetProcess
xsltParseStylesheetVariable
xsltParseTemplateContent
xsltPreComputeExtModuleElement
xsltPrintErrorContext
xsltProcessOneNode
xsltProcessingInstruction
xsltProfileStylesheet
xsltQuoteOneUserParam
xsltQuoteUserParams
xsltRegisterAllElement
xsltRegisterAllExtras
xsltRegisterAllFunctions
xsltRegisterExtElement
xsltRegisterExtFunction
xsltRegisterExtModule
xsltRegisterExtModuleElement
xsltRegisterExtModuleFull
xsltRegisterExtModuleFunction
xsltRegisterExtModuleTopLevel
xsltRegisterExtPrefix
xsltRegisterExtras
xsltRegisterLocalRVT
xsltRegisterPersistRVT
xsltRegisterTestModule
xsltRegisterTmpRVT
xsltReleaseRVT
xsltResolveStylesheetAttributeSet
xsltRunStylesheet
xsltRunStylesheetUser
xsltSaveProfiling
xsltSaveResultTo
xsltSaveResultToFd
xsltSaveResultToFile
xsltSaveResultToFilename
xsltSaveResultToString
xsltSecurityAllow
xsltSecurityForbid
xsltSetCtxtParseOptions
xsltSetCtxtSecurityPrefs
xsltSetCtxtSortFunc
xsltSetDebuggerCallbacks
xsltSetDebuggerStatus
xsltSetDefaultSecurityPrefs
xsltSetGenericDebugFunc
xsltSetGenericErrorFunc
xsltSetLoaderFunc
xsltSetSecurityPrefs
xsltSetSortFunc
xsltSetTransformErrorFunc
xsltSetXIncludeDefault
xsltShutdownCtxtExts
xsltShutdownExts
xsltSort
xsltSplitQName
xsltStrxfrm
xsltStyleGetExtData
xsltStylePreCompute
xsltSystemPropertyFunction
xsltTemplateProcess
xsltTestCompMatchList
xsltText
xsltTimestamp
xsltTransformError
xsltUninit
xsltUnparsedEntityURIFunction
xsltUnregisterExtModule
xsltUnregisterExtModuleElement
xsltUnregisterExtModuleFunction
xsltUnregisterExtModuleTopLevel
xsltValueOf
xsltVariableLookup
xsltXPathCompile
xsltXPathCompileFlags
xsltXPathFunctionLookup
xsltXPathGetTransformContext
xsltXPathVariableLookup

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37027909811ef440d4ab6bfcaf0c3894

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73Certificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

b3:64:74:43:d9:67:34:ad:01:26:2d:30:f5:3d:94:a2:53:a8:1f:92Signer

Headers

DLL Characteristics

File Characteristics

Imports

libxml2

kernel32

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.rdata Size: 91KB - Virtual size: 90KB

.data Size: 7KB - Virtual size: 17KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

b3:64:74:43:d9:67:34:ad:01:26:2d:30:f5:3d:94:a2:53:a8:1f:92
Signer

.text
Size: 221KB - Virtual size: 221KB

.rdata
Size: 91KB - Virtual size: 90KB

.data
Size: 7KB - Virtual size: 17KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB