c7cb2ada9efb4274cd83bc3de1b982d4ff055e16fdb6660e70d4e8ee4d178962[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

c7cb2ada9efb4274cd83bc3de1b982d4ff055e16fdb6660e70d4e8ee4d178962.dll
Size

2.7MB
MD5

1011bf1ff38ca443cdb224bb86582795
SHA1

b65f472347e3afd8a87d8e540f45f72dd8f9a9a4
SHA256

c7cb2ada9efb4274cd83bc3de1b982d4ff055e16fdb6660e70d4e8ee4d178962
SHA512

702918b7794d713c350f692ed9c2dc0c45f0fb329d49740d9b6894c237d365ad3420638f0034a886156c22555fe9df274fd12a68184715c7e2e8856f381b1e4b
SSDEEP

49152:lGtlq2IU6ixoVwASON7JGFdFgo4ctMXT5GgDtq8ftQRWQOh5POI0Xy7dPWO0:Z+wiFIzfaRTy7UO

Score

1^/10

Malware Config

Signatures

Files

c7cb2ada9efb4274cd83bc3de1b982d4ff055e16fdb6660e70d4e8ee4d178962.dll
.dll windows:6 windows x64 arch:x64

0b2c98debf879de1cf8f9001e92b6b5b

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:0a:3f:bc:ef:f0:c6:c8:7d:96:4b:41:4d:1a:a9:8e:ed:68:87:15:ee:c6:04:cf:3f:77:ef:da:f1:2a:2a:0f
Signer

Actual PE Digest

8f:0a:3f:bc:ef:f0:c6:c8:7d:96:4b:41:4d:1a:a9:8e:ed:68:87:15:ee:c6:04:cf:3f:77:ef:da:f1:2a:2a:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\x64\Release\libyara.NET.pdb

Imports

kernel32

IsProcessorFeaturePresent
GetModuleHandleW
SwitchToThread
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
IsDebuggerPresent
ReadConsoleA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
GetLastError
SetLastError
WideCharToMultiByte
MultiByteToWideChar
Sleep
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
CreateFileA
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetFileSize
ReadFile
GetCurrentProcess
OpenProcess
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
QueryPerformanceFrequency
TerminateProcess
EnterCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleExW
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
FormatMessageW
SwitchToFiber
DeleteFiber
SetConsoleMode
GetConsoleMode
FindNextFileW
FindFirstFileW
FindClose
LoadLibraryW
LoadLibraryA
FreeLibrary
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber

vcruntime140

__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
memmove
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
memcpy
memcmp
strrchr
memchr
wcsstr
memset
__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
strstr
longjmp
strchr
__intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm
_configure_narrow_argv
_register_onexit_function
_execute_onexit_table
_initialize_narrow_environment
strerror
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_errno
_initialize_onexit_table
abort
signal
_exit
raise
_seh_filter_dll
strerror_s
_initterm_e

api-ms-win-crt-heap-l1-1-0

malloc
realloc
_callnewh
free

advapi32

LookupPrivilegeValueA
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptCreateHash
AdjustTokenPrivileges
OpenProcessToken
CryptDestroyHash
CryptSignHashW
CryptGetProvParam
CryptSetHashParam
CryptEnumProvidersW
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
DeregisterEventSource
RegisterEventSourceW
ReportEventW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
_sopen_s
_filelength
__acrt_iob_func
__stdio_common_vsprintf
ftell
fseek
fwrite
fread
fopen
__stdio_common_vfprintf
clearerr
ferror
fputs
getc
fclose
fopen_s
__stdio_common_vsscanf
feof
fflush
fgets
_fileno
fgetc
_setmode
_wfopen
_read
_close

api-ms-win-crt-string-l1-1-0

strcmp
strcspn
strspn
strnlen
isprint
_stricmp
_strnicmp
strncpy
strncmp
isalnum
isxdigit
_strdup
isspace
isdigit
tolower

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s

api-ms-win-crt-convert-l1-1-0

strtol
atoi
strtoll
strtod
_strtoi64
strtoul
atof

api-ms-win-crt-math-l1-1-0

pow
log2
_dclass

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

crypt32

CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertGetCertificateContextProperty
CertOpenStore
CertDuplicateCertificateContext

ws2_32

bind
accept
WSASetLastError
send
recv
freeaddrinfo
getaddrinfo
WSAGetLastError
closesocket
WSACleanup
connect
listen
setsockopt
WSAStartup
gethostbyname
socket
ntohs
getsockopt
getsockname
ioctlsocket
getnameinfo

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

bcrypt

BCryptGenRandom

mscoree

_CorDllMain

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 691KB - Virtual size: 690KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b2c98debf879de1cf8f9001e92b6b5b

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

8f:0a:3f:bc:ef:f0:c6:c8:7d:96:4b:41:4d:1a:a9:8e:ed:68:87:15:ee:c6:04:cf:3f:77:ef:da:f1:2a:2a:0fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

advapi32

msvcp140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

user32

crypt32

ws2_32

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

bcrypt

mscoree

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.nep Size: 3KB - Virtual size: 3KB

.rdata Size: 691KB - Virtual size: 690KB

.data Size: 15KB - Virtual size: 31KB

.pdata Size: 99KB - Virtual size: 99KB

.gfids Size: 512B - Virtual size: 44B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 19KB - Virtual size: 19KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

8f:0a:3f:bc:ef:f0:c6:c8:7d:96:4b:41:4d:1a:a9:8e:ed:68:87:15:ee:c6:04:cf:3f:77:ef:da:f1:2a:2a:0f
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.nep
Size: 3KB - Virtual size: 3KB

.rdata
Size: 691KB - Virtual size: 690KB

.data
Size: 15KB - Virtual size: 31KB

.pdata
Size: 99KB - Virtual size: 99KB

.gfids
Size: 512B - Virtual size: 44B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 19KB - Virtual size: 19KB