ultraVNC[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ultraVNC.dll
Size

490KB
MD5

b44b94f0b1dad44cd6c97f13471a0b2d
SHA1

b12a28bf36d0322714872e270f07f0de057c9d57
SHA256

0676b2dfd11cc9dbd721094881bd12f1b7995a1d3fedd5a6fbbb21e4a4cf3221
SHA512

263833b21ad1de52bd749033463a7e057149dc5650b0616aa0fb52481c416e7889fdb9d3ede1b7a5f510db39217c5a8ad807232f4682c25c806a379806a78bb7
SSDEEP

12288:ME/FhthSahIfG6hn15a9eGu7U4fH1B8qgIpuPlo7+H88Cf74gPWXAld8TD:z/LthSahIfGreGurH6dD88Cf74gPBC

Score

1^/10

Malware Config

Signatures

Files

ultraVNC.dll
.dll windows:6 windows x86 arch:x86

a391d2e49d05d75edb5a4082bc932eeb

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/10/2018, 00:00

Not After

07/10/2021, 12:00

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:9c:9c:c1:96:22:8d:d2:94:b4:08:a7:68:3c:82:7f:4c:d1:d1:db
Signer

Actual PE Digest

c1:9c:9c:c1:96:22:8d:d2:94:b4:08:a7:68:3c:82:7f:4c:d1:d1:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_win32\build\src\steam2wrapper\Release\steam.pdb

Imports

shell32

ShellExecuteW
CommandLineToArgvW

kernel32

GetExitCodeProcess
OpenProcess
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
FindClose
FindFirstFileW
DeviceIoControl
GetLastError
VerSetConditionMask
CreateDirectoryW
CreateFileA
DeleteFileW
GetFullPathNameW
WriteFile
SetLastError
Sleep
GetCurrentProcess
GetCurrentProcessId
DeleteCriticalSection
GetVersionExA
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
MoveFileExW
VerifyVersionInfoW
LocalAlloc
InitializeCriticalSection
CloseHandle
WriteConsoleW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
DecodePointer
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
GetFileAttributesW
GetCurrentDirectoryW
GetCommandLineW
GetCommandLineA
FreeLibrary
GetEnvironmentVariableA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
SetEnvironmentVariableW
GetSystemInfo
GetProcessAffinityMask
HeapAlloc
HeapFree
HeapSize
HeapValidate
DebugBreak
GetProcessHeaps
LCMapStringW
CompareStringW
GetConsoleOutputCP
GetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetThreadAffinityMask
ExitProcess
FindFirstFileExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TlsFree
TlsSetValue
TlsGetValue
PeekNamedPipe
GetFileType
VirtualQuery
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
TlsAlloc
GetModuleHandleW
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
SetProcessAffinityMask
SetUnhandledExceptionFilter
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceA
GetDriveTypeW
GetFileInformationByHandle
GetFileSizeEx
ReadFile
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
GetTempPathW
SleepEx
GetSystemTimeAsFileTime
GetTempPathA
RaiseException
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
TerminateProcess
GlobalMemoryStatusEx
VirtualAlloc
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
SwitchToThread
CreateThread
GetCurrentThread
OpenThread
TerminateThread
GetExitCodeThread

user32

SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EndDialog
DialogBoxParamA
SetWindowPos
wsprintfA
GetWindowRect
EnumWindows
GetWindowThreadProcessId
CloseClipboard
IsWindowVisible
GetDesktopWindow
MessageBoxA
GetWindowTextLengthA
EmptyClipboard
SetClipboardData
OpenClipboard

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyA

oleaut32

VariantClear

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

ws2_32

htonl
htons
ntohl
ntohs
connect
freeaddrinfo
closesocket
recv
send
socket
__WSAFDIsSet
bind
recvfrom
select
sendto
getaddrinfo

Exports

Exports

SteamAbortCall
SteamAbortOngoingUserIDTicketValidation
SteamAckSubscriptionReceipt
SteamBlockingCall
SteamChangeAccountName
SteamChangeEmailAddress
SteamChangeForgottenPassword
SteamChangeOfflineStatus
SteamChangePassword
SteamChangePersonalQA
SteamCheckAppOwnership
SteamCleanup
SteamClearError
SteamCloseFile
SteamCreateAccount
SteamCreateCachePreloaders
SteamCreateLogContext
SteamDefragCaches
SteamDeleteAccount
SteamEnumerateApp
SteamEnumerateAppDependency
SteamEnumerateAppIcon
SteamEnumerateAppLaunchOption
SteamEnumerateAppVersion
SteamEnumerateSubscription
SteamEnumerateSubscriptionDiscount
SteamEnumerateSubscriptionDiscountQualifier
SteamFindApp
SteamFindClose
SteamFindFirst
SteamFindFirst64
SteamFindNext
SteamFindNext64
SteamFindServersGetErrorString
SteamFindServersIterateServer
SteamFindServersNumServers
SteamFlushCache
SteamFlushFile
SteamForceCellId
SteamForgetAllHints
SteamGenerateSuggestedAccountNames
SteamGetAccountStatus
SteamGetAppCacheSize
SteamGetAppDLCStatus
SteamGetAppDependencies
SteamGetAppDir
SteamGetAppIds
SteamGetAppPurchaseCountry
SteamGetAppStats
SteamGetAppUpdateStats
SteamGetAppUserDefinedInfo
SteamGetAppUserDefinedRecord
SteamGetCacheDecryptionKey
SteamGetCacheDefaultDirectory
SteamGetCacheFilePath
SteamGetCachePercentFragmentation
SteamGetContentServerInfo
SteamGetCurrentAppId
SteamGetCurrentCellID
SteamGetCurrentEmailAddress
SteamGetDepotParent
SteamGetEncryptedUserIDTicket
SteamGetEncryptionKeyToSendToNewClient
SteamGetFileAttributeFlags
SteamGetLocalClientVersion
SteamGetLocalFileCopy
SteamGetNumAccountsWithEmailAddress
SteamGetOfflineStatus
SteamGetSponsorUrl
SteamGetSubscriptionExtendedInfo
SteamGetSubscriptionIds
SteamGetSubscriptionPurchaseCountry
SteamGetSubscriptionReceipt
SteamGetSubscriptionStats
SteamGetTotalUpdateStats
SteamGetUser
SteamGetUserType
SteamGetVersion
SteamGetc
SteamHintResourceNeed
SteamInitializeUserIDTicketValidator
SteamInsertAppDependency
SteamIsAccountNameInUse
SteamIsAppSubscribed
SteamIsCacheLoadingEnabled
SteamIsFileImmediatelyAvailable
SteamIsFileNeededByApp
SteamIsFileNeededByCache
SteamIsLoggedIn
SteamIsSecureComputer
SteamIsSubscribed
SteamIsUsingSdkContentServer
SteamLaunchApp
SteamLoadCacheFromDir
SteamLoadFileToApp
SteamLoadFileToCache
SteamLog
SteamLogResourceLoadFinished
SteamLogResourceLoadStarted
SteamLogin
SteamLogout
SteamMiniDumpInit
SteamMountAppFilesystem
SteamMountFilesystem
SteamMoveApp
SteamNumAppsRunning
SteamOpenFile
SteamOpenFile64
SteamOpenFileEx
SteamOpenTmpFile
SteamOptionalCleanUpAfterClientHasDisconnected
SteamPauseCachePreloading
SteamPrintFile
SteamProcessCall
SteamProcessOngoingUserIDTicketValidation
SteamPutc
SteamReadFile
SteamRefreshAccountInfo
SteamRefreshAccountInfo2
SteamRefreshAccountInfoEx
SteamRefreshLogin
SteamReleaseCacheFiles
SteamRemoveAppDependency
SteamRepairOrDecryptCaches
SteamRequestAccountsByCdKeyEmail
SteamRequestAccountsByEmailAddressEmail
SteamRequestEmailAddressVerificationEmail
SteamRequestForgottenPasswordEmail
SteamResumeCachePreloading
SteamSeekFile
SteamSeekFile64
SteamSetAppCacheSize
SteamSetAppVersion
SteamSetCacheDefaultDirectory
SteamSetMaxStallCount
SteamSetNotificationCallback
SteamSetUser
SteamSetUser2
SteamSetvBuf
SteamShutdownEngine
SteamShutdownSteamBridgeInterface
SteamShutdownUserIDTicketValidator
SteamSizeFile
SteamSizeFile64
SteamStartEngine
SteamStartEngineEx
SteamStartLoadingCache
SteamStartValidatingNewValveCDKey
SteamStartValidatingUserIDTicket
SteamStartup
SteamStat
SteamStat64
SteamStopLoadingCache
SteamSubscribe
SteamTellFile
SteamTellFile64
SteamUninstall
SteamUnmountAppFilesystem
SteamUnmountFilesystem
SteamUnsubscribe
SteamUpdateAccountBillingInfo
SteamUpdateSubscriptionBillingInfo
SteamVerifyEmailAddress
SteamVerifyPassword
SteamWaitForAppReadyToLaunch
SteamWaitForAppResources
SteamWaitForResources
SteamWasBlobRegistryDeleted
SteamWriteFile
SteamWriteMiniDumpFromAssert
SteamWriteMiniDumpSetComment
SteamWriteMiniDumpUsingExceptionInfo
SteamWriteMiniDumpUsingExceptionInfoWithBuildId
SteamWriteMiniDumpWithAppID
_f
g_dwDllEntryThreadId

Sections

.text
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a391d2e49d05d75edb5a4082bc932eeb

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

c1:9c:9c:c1:96:22:8d:d2:94:b4:08:a7:68:3c:82:7f:4c:d1:d1:dbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

kernel32

user32

advapi32

oleaut32

psapi

ws2_32

Exports

Exports

Sections

.text Size: 339KB - Virtual size: 338KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 7KB - Virtual size: 367KB

.reloc Size: 20KB - Virtual size: 20KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

c1:9c:9c:c1:96:22:8d:d2:94:b4:08:a7:68:3c:82:7f:4c:d1:d1:db
Signer

.text
Size: 339KB - Virtual size: 338KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 7KB - Virtual size: 367KB

.reloc
Size: 20KB - Virtual size: 20KB