21708a4a70fd92c39d0e39d4c19eaf6e42c03516b0dbdd3231fc0b020c0d6c22[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

21708a4a70fd92c39d0e39d4c19eaf6e42c03516b0dbdd3231fc0b020c0d6c22.dll
Size

134KB
MD5

d0ab8eafb28aa87198d76b7786c5de20
SHA1

ca7d1d249a0548161391fe4aaa306712983c36af
SHA256

21708a4a70fd92c39d0e39d4c19eaf6e42c03516b0dbdd3231fc0b020c0d6c22
SHA512

9ed2ed60c28610081d6b90d409f7e12e48edc2bf065a1ab00c3851a1027f5010b06803b9c0e92fe9094e4d5feb80df0b639ccc1971528505d6ceae27d08fa99a
SSDEEP

1536:HCXemYmS7Zn4Vh0Y6wDcfIScDsRVCAnZaiFgS1ZJ08gBRHais/1K9ctdyg8RaK9U:HaVwZq0YGIbiFPzmps/1WctR8RaKId

Score

1^/10

Malware Config

Signatures

Files

21708a4a70fd92c39d0e39d4c19eaf6e42c03516b0dbdd3231fc0b020c0d6c22.dll
.dll windows:4 windows x86 arch:x86

470ba5b4682c2719903df63c7c142921

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:76:d4:e3:97:b5:97:9e:7f:f7:b4:7c:f5:ba:fb:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

06/05/2010, 00:00

Not After

05/05/2013, 23:59

Subject

CN=Wuhan Tianyu Software Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Wuhan Tianyu Software Co.\, Ltd.,L=WuHan,ST=HuBei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

19:a4:22:f1:ac:1f:1d:7b:09:21:56:7a:b2:9e:18:87:ea:3a:98:9b
Signer

Actual PE Digest

19:a4:22:f1:ac:1f:1d:7b:09:21:56:7a:b2:9e:18:87:ea:3a:98:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSAStartup
WSACleanup
socket
htonl
bind
inet_ntoa
closesocket
htons
connect
shutdown
select
__WSAFDIsSet
recv
send
gethostname
gethostbyname
ioctlsocket
inet_addr

winmm

timeGetTime

kernel32

CopyFileA
GetCurrentDirectoryA
GetFileAttributesA
GetSystemDirectoryA
GetVersion
WaitForSingleObject
CreateEventA
CloseHandle
lstrcatA
lstrcpyA
lstrcmpiA
lstrlenA
GetLocalTime
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetVolumeInformationA
LocalFree
FormatMessageA
GetSystemTime
LeaveCriticalSection
EnterCriticalSection
Sleep
GetExitCodeThread
ResumeThread
SetThreadPriority
CreateThread
DeleteCriticalSection
GetModuleFileNameA
InitializeCriticalSection
WriteFile
SetFilePointer
GetWindowsDirectoryA
lstrcpynA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
CreateFileA
GetLastError
DeleteFileA
DeviceIoControl
GetTickCount
LoadLibraryA
GetThreadLocale
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetEndOfFile
SetEvent
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RaiseException
HeapReAlloc
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
GetStdHandle
HeapSize
ReadFile

user32

GetActiveWindow
DestroyWindow
CreateDialogParamA
SendMessageA
DialogBoxParamA
GetDlgItem
GetWindowTextA
MessageBoxA
SetFocus
EndDialog
SetWindowTextA
wsprintfA

advapi32

OpenSCManagerA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptEncrypt
CryptDestroyKey
CryptReleaseContext
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegEnumValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyA
RegSetValueExA
RegCloseKey
ControlService
DeleteService
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle

Exports

Exports

D_Begin_API
D_End_API
D_Middle_API
D_SetSvrIP_API
GetUserInfo_API

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

470ba5b4682c2719903df63c7c142921

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

46:76:d4:e3:97:b5:97:9e:7f:f7:b4:7c:f5:ba:fb:c4Certificate

Extended Key Usages

Key Usages

19:a4:22:f1:ac:1f:1d:7b:09:21:56:7a:b2:9e:18:87:ea:3a:98:9bSigner

Headers

File Characteristics

Imports

wsock32

winmm

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 8KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

46:76:d4:e3:97:b5:97:9e:7f:f7:b4:7c:f5:ba:fb:c4
Certificate

19:a4:22:f1:ac:1f:1d:7b:09:21:56:7a:b2:9e:18:87:ea:3a:98:9b
Signer

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 8KB