VERSION[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

VERSION.dll
Size

893KB
MD5

a51c6980b440242b5113fad66b87cc2f
SHA1

b46423408e69f4dc6d320cf7fc7ecf59ce53821d
SHA256

048134cd2660167632beac0b43f9caac001b88f588ed5353e30236ef6478a8e1
SHA512

7f464f9113e3923cfe5b92726add963414c352ea7113309b6a1e689e0a34cd3643768f27285d8dd42609158a3991212475273ff43b0371aa446e4a8e10b620c1
SSDEEP

12288:8A31Vu4ykUgm6vzcVehchBiWUskN/vkypbKSXzJl8acPH:8gVu4ykUwvz+1BpUBvkdCFl8jPH

Score

1^/10

Malware Config

Signatures

Files

VERSION.dll
.dll windows:6 windows x64 arch:x64

42096025e642a83340d077a0db9d9a7b

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/03/2021, 00:00

Not After

05/06/2024, 23:59

Subject

CN=Micro-Star International CO.\, LTD.,O=Micro-Star International CO.\, LTD.,L=Zhonghe District,ST=New Taipei City,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ad:87:ba:3f:0c:32:d0:14:91:17:a4:fd:d0:ff:37:7b:59:c7:c1:6a
Signer

Actual PE Digest

ad:87:ba:3f:0c:32:d0:14:91:17:a4:fd:d0:ff:37:7b:59:c7:c1:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

rust_dave_sideload.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

kernel32

HeapSize
GetStringTypeW
SetStdHandle
CloseHandle
GetProcAddress
GetNativeSystemInfo
VirtualQuery
VirtualAlloc
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
SetThreadStackGuarantee
GetCurrentThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
SetHandleInformation
WriteFileEx
SleepEx
TerminateProcess
HeapFree
lstrlenW
ReleaseMutex
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
CopyFileExW
ReadFile
GetConsoleMode
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
RtlUnwind
CreateThread
GetFullPathNameW
GetModuleHandleA
GetProcessHeap
HeapAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetConsoleOutputCP
WriteFile
HeapReAlloc
ReadConsoleW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

ws2_32

listen
bind
getaddrinfo
WSASocketW
WSAGetLastError
freeaddrinfo
WSACleanup
WSAStartup
closesocket
accept

Exports

Exports

DllMain
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: 341KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42096025e642a83340d077a0db9d9a7b

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75Certificate

Extended Key Usages

Key Usages

ad:87:ba:3f:0c:32:d0:14:91:17:a4:fd:d0:ff:37:7b:59:c7:c1:6aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

bcrypt

advapi32

ntdll

ws2_32

Exports

Exports

Sections

.text Size: 341KB - Virtual size: 341KB

.rdata Size: 434KB - Virtual size: 433KB

.data Size: 89KB - Virtual size: 94KB

.pdata Size: 17KB - Virtual size: 16KB

.reloc Size: 7KB - Virtual size: 6KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
Certificate

ad:87:ba:3f:0c:32:d0:14:91:17:a4:fd:d0:ff:37:7b:59:c7:c1:6a
Signer

.text
Size: 341KB - Virtual size: 341KB

.rdata
Size: 434KB - Virtual size: 433KB

.data
Size: 89KB - Virtual size: 94KB

.pdata
Size: 17KB - Virtual size: 16KB

.reloc
Size: 7KB - Virtual size: 6KB