f45cb1d32d3f5ad70767bf32bb2dd3dbabb4db256b41521669fa5cd96027df30

Sharing

Copy URL Twitter E-mail

General

Target

f45cb1d32d3f5ad70767bf32bb2dd3dbabb4db256b41521669fa5cd96027df30
Size

264KB
MD5

db14e8b596b3213c92c0a197be05a332
SHA1

554d07239d75b52073b64170b1796f1ce77b9367
SHA256

f45cb1d32d3f5ad70767bf32bb2dd3dbabb4db256b41521669fa5cd96027df30
SHA512

fa49d30eb89e541b6f9331a44e6a76c6498a20a183f0a97365786a2df7ab9900d6f4e7271ef5f61239a2c8c151209cb27916dfe61af4afd539ef2d3c1dc75f02
SSDEEP

6144:/j9v1Bo600WuLUG2CXoshT6NqxpQO/moeuzY8:pv1Bo63WuLUGPXostGqxA8

Score

1^/10

Malware Config

Signatures

Files

f45cb1d32d3f5ad70767bf32bb2dd3dbabb4db256b41521669fa5cd96027df30
.dll regsvr32 windows:6 windows x64 arch:x64

a2e564675bcdabe8e6423966c32bccce

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:4d:d3:64:11:70:e6:c2:8f:d6:04:e3
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

27/11/2023, 08:43

Not After

27/11/2024, 08:43

Subject

SERIALNUMBER=23829868,CN=CyberLink Corp.,OU=IT,O=CyberLink Corp.,STREET=15F.\, No. 100\, Minquan Rd.\, Xindian Dist.,L=New Taipei City,ST=New Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cc:50:f5:da:29:0f:05:98:61:5f:67:29:d1:35:8e:27:ca:f4:de:00:5f:64:af:c0:ad:bd:7e:24:a8:5c:45:ea
Signer

Actual PE Digest

cc:50:f5:da:29:0f:05:98:61:5f:67:29:d1:35:8e:27:ca:f4:de:00:5f:64:af:c0:ad:bd:7e:24:a8:5c:45:ea

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\RDBuildPool\20220309-06339\BREPlayerWrapper\x64\Unicode_Release\BREPlayerWrapperU.pdb

Imports

winmm

waveInGetNumDevs
timeSetEvent
timeGetTime
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
mixerGetLineInfoW
mixerClose
mixerOpen
mixerGetDevCapsW
mixerGetNumDevs
waveInGetDevCapsW

shlwapi

PathCombineW
PathFileExistsW
PathAddBackslashW

gdiplus

GdipDisposeImage
GdipGetImageThumbnail
GdipCloneImage
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream
GdipAlloc
GdipFree

mfc110u

ord9821
ord9823
ord9822
ord9820
ord9824
ord5327
ord11252
ord11253
ord8681
ord11609
ord3660
ord11463
ord14029
ord8507
ord11740
ord6591
ord10536
ord8797
ord3118
ord13334
ord11779
ord11777
ord1685
ord1694
ord1702
ord1698
ord1707
ord4698
ord4735
ord4706
ord4718
ord4714
ord4710
ord4741
ord4731
ord4702
ord4745
ord4723
ord4687
ord4693
ord4726
ord4299
ord5456
ord9232
ord4291
ord2912
ord14031
ord7499
ord14037
ord6493
ord11244
ord13685
ord13582
ord13175
ord5594
ord2575
ord11644
ord3753
ord3223
ord3224
ord3117
ord11688
ord4665
ord984
ord8321
ord6482
ord4635
ord3088
ord2160
ord14098
ord11921
ord14045
ord11864
ord4595
ord12432
ord8262
ord8269
ord2854
ord1027
ord286
ord296
ord6371
ord2296
ord2286
ord8011
ord7245
ord1445
ord7928
ord11767
ord9969
ord12438
ord12376
ord4384
ord7868
ord5059
ord2385
ord12056
ord12055
ord14030
ord7498
ord14036
ord8939
ord3952
ord3890
ord12457
ord7516
ord1962
ord11503
ord11502
ord13909
ord12045
ord7566
ord14108
ord5991
ord14110
ord5993
ord14109
ord5992
ord977
ord6477
ord3673
ord5577
ord2644
ord7758
ord9791
ord3154
ord2306
ord2214
ord2111
ord2282
ord2182
ord472
ord2317
ord2284
ord2318
ord11759
ord7765
ord11771
ord11739
ord4959
ord5239
ord5427
ord8891
ord5215
ord5430
ord4962
ord5105
ord4943
ord7310
ord7311
ord7301
ord5103
ord7767
ord9786
ord8750
ord1032
ord322
ord2292
ord1480
ord1419
ord12157
ord7610
ord12753
ord13418
ord956
ord1381
ord12155
ord7608
ord12751
ord13417
ord910
ord1494
ord280
ord1632
ord2290
ord266
ord265
ord1482
ord3157
ord13222
ord5873
ord5787
ord2263
ord2217
ord14040
ord12073
ord4614
ord1441
ord3670
ord1483
ord323
ord1033
ord2273
ord2315
ord473

msvcr110

_vsnprintf_s
fgetpos
fgetc
fflush
fclose
_wmkdir
malloc
wcscpy_s
ceil
_recalloc
calloc
vswprintf_s
_wcsnicmp
wcsstr
wcsncpy_s
_itow_s
__CxxFrameHandler3
memcpy
memset
_purecall
memcpy_s
strcat_s
memmove
_wsplitpath_s
_vsnwprintf_s
swprintf_s
ungetwc
fputwc
fgetwc
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_lock_file
_unlock_file
free
strftime
_localtime64_s
_time64
??0bad_cast@std@@QEAA@PEBD@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBV01@@Z
??1bad_cast@std@@UEAA@XZ
_CxxThrowException
wcscat_s
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
_onexit
__C_specific_handler
__dllonexit
_calloc_crt
_unlock
_lock
memcmp
memmove_s
strncpy_s

kernel32

GlobalUnlock
GlobalFree
LoadLibraryW
InitializeCriticalSectionAndSpinCount
CreateFileW
WriteFile
CloseHandle
GlobalReAlloc
SetFilePointer
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
WideCharToMultiByte
DisableThreadLibraryCalls
lstrlenA
lstrlenW
GetModuleFileNameA
MultiByteToWideChar
VirtualAlloc
VirtualFree
GetCurrentProcess
GetCurrentThreadId
GlobalLock
ResetEvent
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
DuplicateHandle
GetSystemInfo
lstrcmpW
CreateEventW
CreateSemaphoreW
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
LocalAlloc
LocalFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GlobalAlloc
LoadLibraryExW
FreeLibrary
GetVersionExW
Sleep
GetTickCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
OutputDebugStringW
OutputDebugStringA
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
SetEvent
CompareFileTime

user32

MsgWaitForMultipleObjects
PostThreadMessageW
RegisterWindowMessageW
ReleaseDC
EnableWindow
KillTimer
SetTimer
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextW
GetDC
SetParent
GetQueueStatus
GetWindowRect
UnregisterClassW

gdi32

GetObjectW
CreateDIBSection
SetStretchBltMode
SelectObject
SelectPalette
RealizePalette
GetDIBits
CreateCompatibleDC
BitBlt
GetStockObject
StretchDIBits

advapi32

RegEnumValueW
RegSetValueW
RegEnumKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

atl110

ord49
ord56
ord68

ole32

CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
SysFreeString

msvcp110

??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7ios_base@std@@6B@
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$codecvt@_WDH@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Add_vtordisp1@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Add_vtordisp2@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@_WDH@std@@QEBAHAEAHPEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDH@std@@QEBAHAEAHPEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?unshift@?$codecvt@_WDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?_Getcat@?$codecvt@_WDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2e564675bcdabe8e6423966c32bccce

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

11:4d:d3:64:11:70:e6:c2:8f:d6:04:e3Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

cc:50:f5:da:29:0f:05:98:61:5f:67:29:d1:35:8e:27:ca:f4:de:00:5f:64:af:c0:ad:bd:7e:24:a8:5c:45:eaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

shlwapi

gdiplus

mfc110u

msvcr110

kernel32

user32

gdi32

advapi32

shell32

atl110

ole32

oleaut32

msvcp110

Exports

Exports

Sections

.text Size: 146KB - Virtual size: 146KB

.rdata Size: 84KB - Virtual size: 84KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

11:4d:d3:64:11:70:e6:c2:8f:d6:04:e3
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

cc:50:f5:da:29:0f:05:98:61:5f:67:29:d1:35:8e:27:ca:f4:de:00:5f:64:af:c0:ad:bd:7e:24:a8:5c:45:ea
Signer

.text
Size: 146KB - Virtual size: 146KB

.rdata
Size: 84KB - Virtual size: 84KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB