mozglue[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mozglue.dll.exe
Size 163KB
Sample251004-ar2qvsgl4s
SHA256 048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b
MD5 ca52212011191040d4ad8fbc9b8a9568
SHA1 c40402c67627a0ae2d1d2540e487a3e39d62ec45
SHA512 7ab224562f02cb8cfc047bd99bee1d47179a2b24566a75662be6e57d7abaab680a3c5a7df3dbeecad8bd561eb4d1c6cbc6adab883f93b89a4200fc6bdded85d8
SSDEEP 3072:N/YMAHtU/BbeXJy9x4N48TuxpXvV2w3vk9EAXJd7ZU9pk6u1pPr0ay0KdFi9jCp7:NCi/BbeA9C4yQvsHEnTEp4L0qFi9jCp7
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
mozglue.dll.exe

File Explorer

mozglue.dll.exe

.dll 163KB

mozglue.dll.exe

IMPHASH 9fcd8f5d38eb61c629c9bd3bd71964da
SHA256 048d83df38eb4befb4127406871e043e5b63aa36ab62d32b846bb10070bd415b
MD5 ca52212011191040d4ad8fbc9b8a9568
SHA1 c40402c67627a0ae2d1d2540e487a3e39d62ec45
SHA512 7ab224562f02cb8cfc047bd99bee1d47179a2b24566a75662be6e57d7abaab680a3c5a7df3dbeecad8bd561eb4d1c6cbc6adab883f93b89a4200fc6bdded85d8
SSDEEP 3072:N/YMAHtU/BbeXJy9x4N48TuxpXvV2w3vk9EAXJd7ZU9pk6u1pPr0ay0KdFi9jCp7:NCi/BbeA9C4yQvsHEnTEp4L0qFi9jCp7
MD5 SHA1 SHA512 SSDEEP

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f7:13:c8:a4:36:6b:cb:5d:de:de:83:c2:08:06:a0:c4:d2:6e:ab:90:c3:40:fe:21:ec:c6:48:3c:5c:8b:ad:6e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Troy Smith,O=Troy Smith,POSTALCODE=4132,STREET=6 venture st,L=crestmead,ST=queensland,C=AU

Chains

Jun 29, 2018

CN=Troy Smith,O=Troy Smith,POSTALCODE=4132,STREET=6 venture st,L=crestmead,ST=queensland,C=AU

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

4e:f6:3a:e5:d0:f5:e8:5c:6f:0e:f8:39:21:be:ba:89:40:71:86:01

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Troy Smith,O=Troy Smith,POSTALCODE=4132,STREET=6 venture st,L=crestmead,ST=queensland,C=AU

Chains

Jun 29, 2018

CN=Troy Smith,O=Troy Smith,POSTALCODE=4132,STREET=6 venture st,L=crestmead,ST=queensland,C=AU

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Troy Smith,O=Troy Smith,POSTALCODE=4132,STREET=6 venture st,L=crestmead,ST=queensland,C=AU

Serial Number

bf:04:e2:d2:c0:29:14:f6:da:db:40:99:bb:b8:47:1a

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 21, 2018 - May 21, 2019

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Troy Smith,O=Troy Smith,POSTALCODE=4132,STREET=6 venture st,L=crestmead,ST=queensland,C=AU

Serial Number

bf:04:e2:d2:c0:29:14:f6:da:db:40:99:bb:b8:47:1a

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 21, 2018 - May 21, 2019

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

113968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

VerSetConditionMask SearchPathW CreateFileW WriteFile IsDebuggerPresent OutputDebugStringA EncodePointer DecodePointer CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess GetCurrentThreadId GetSystemInfo VirtualAllocEx VirtualProtectEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleHandleA GetProcAddress LoadLibraryExA LoadLibraryW VerifyVersionInfoA TerminateProcess GetEnvironmentVariableA InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue VirtualAlloc VirtualFree DisableThreadLibraryCalls RtlLookupFunctionEntry RtlVirtualUnwind DuplicateHandle GetLastError TryEnterCriticalSection SetEvent WaitForSingleObject CreateEventA SignalObjectAndWait GetCurrentThread SuspendThread ResumeThread GetThreadContext LocalFree FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency DeleteCriticalSection GetProcessTimes GetSystemTime GetTickCount GetSystemTimeAdjustment GetModuleHandleW SystemTimeToFileTime GetSystemTimeAsFileTime GetCurrentProcessId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlCaptureContext FreeLibrary VirtualQuery VirtualProtect RaiseException InitializeSListHead

dbghelp

SymLoadModule64 SymFromAddr SymInitialize SymGetLineFromAddr64 SymGetModuleInfo64 EnumerateLoadedModules64 SymSetOptions

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_BADOFF@std@@3_JB ??_7ios_base@std@@6B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@

vcruntime140

memcpy memset memmove __C_specific_handler __std_type_info_destroy_list strchr

api-ms-win-crt-runtime-l1-1-0

_initterm_e _invalid_parameter_noinfo_noreturn _errno _beginthreadex _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm

api-ms-win-crt-string-l1-1-0

_stricmp _strnicmp wcsncpy isxdigit strncpy

api-ms-win-crt-stdio-l1-1-0

fclose fflush __stdio_common_vfprintf _write __stdio_common_vsprintf __acrt_iob_func fputs _dup

api-ms-win-crt-convert-l1-1-0

_ltoa _strtoui64

api-ms-win-crt-math-l1-1-0

_fdopen _dtest

api-ms-win-crt-environment-l1-1-0

getenv

??0Decimal@blink@@QEAA@AEBV01@@Z ??0Decimal@blink@@QEAA@AEBVEncodedData@01@@Z ??0Decimal@blink@@QEAA@H@Z ??0Decimal@blink@@QEAA@W4Sign@01@H_K@Z ??0SHA1Sum@mozilla@@QEAA@XZ ??0TimeStampValue@mozilla@@AEAA@_K0_N@Z ??4Decimal@blink@@QEAAAEAV01@AEBV01@@Z ??8Decimal@blink@@QEBA_NAEBV01@@Z ??9Decimal@blink@@QEBA_NAEBV01@@Z ??DDecimal@blink@@QEBA?AV01@AEBV01@@Z ??GDecimal@blink@@QEBA?AV01@AEBV01@@Z ??GDecimal@blink@@QEBA?AV01@XZ ??GTimeStampValue@mozilla@@QEBA_KAEBV01@@Z ??HDecimal@blink@@QEBA?AV01@AEBV01@@Z ??KDecimal@blink@@QEBA?AV01@AEBV01@@Z ??MDecimal@blink@@QEBA_NAEBV01@@Z ??NDecimal@blink@@QEBA_NAEBV01@@Z ??ODecimal@blink@@QEBA_NAEBV01@@Z ??PDecimal@blink@@QEBA_NAEBV01@@Z ??XDecimal@blink@@QEAAAEAV01@AEBV01@@Z ??YDecimal@blink@@QEAAAEAV01@AEBV01@@Z ??YTimeStampValue@mozilla@@QEAAAEAV01@_J@Z ??ZDecimal@blink@@QEAAAEAV01@AEBV01@@Z ??ZTimeStampValue@mozilla@@QEAAAEAV01@_J@Z ??_0Decimal@blink@@QEAAAEAV01@AEBV01@@Z ??_FDecimal@blink@@QEAAXXZ ?AcquireStackWalkWorkaroundLock@@YAXXZ ?CheckQPC@TimeStampValue@mozilla@@AEBA_KAEBV12@@Z ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@AEBAXPEBDHHHPEAVStringBuilder@2@@Z ?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@AEBAXPEBDHHPEAVStringBuilder@2@@Z ?DllBlocklist_CheckStatus@@YA_NXZ ?DllBlocklist_Initialize@@YAXXZ ?DllBlocklist_SetInXPCOMLoadOnMainThread@@YAX_N@Z ?DllBlocklist_WriteNotes@@YAXPEAX@Z ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPEADHPEA_NPEAH3@Z ?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAAEBV12@XZ ?FramePointerStackWalk@mozilla@@YA_NP6AXIPEAX00@ZII0PEAPEAX0@Z ?HandleSpecialValues@DoubleToStringConverter@double_conversion@@AEBA_NNPEAVStringBuilder@2@@Z ?HashBytes@mozilla@@YAIPEBX_K@Z ?IsFloat32Representable@mozilla@@YA_NN@Z ?MozDescribeCodeAddress@@YA_NPEAXPEAUMozCodeAddressDetails@@@Z ?MozFormatCodeAddress@@YAXPEADIIPEBXPEBD2_J2I@Z ?MozFormatCodeAddressDetails@@YAXPEADIIPEAXPEBUMozCodeAddressDetails@@@Z ?MozStackWalk@@YA_NP6AXIPEAX00@ZII0_K0@Z ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@AEA_N@Z ?RecordProcessRestart@TimeStamp@mozilla@@SAXXZ ?ReleaseStackWalkWorkaroundLock@@YAXXZ ?ResolutionInTicks@BaseTimeDurationPlatformUtils@mozilla@@SA_JXZ ?Shutdown@TimeStamp@mozilla@@SAXXZ ?StackWalkInitCriticalAddress@@YAXXZ ?Startup@TimeStamp@mozilla@@SAXXZ ?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z ?ToExponential@DoubleToStringConverter@double_conversion@@QEBA_NNHPEAVStringBuilder@2@@Z ?ToFixed@DoubleToStringConverter@double_conversion@@QEBA_NNHPEAVStringBuilder@2@@Z ?ToPrecision@DoubleToStringConverter@double_conversion@@QEBA_NNHPEA_NPEAVStringBuilder@2@@Z ?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z ?ToSecondsSigDigits@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z ?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@AEBA_NNPEAVStringBuilder@2@W4DtoaMode@12@@Z ?TryAcquireStackWalkWorkaroundLock@@YA_NXZ ?Unused@mozilla@@3Uunused_t@1@B ?abs@Decimal@blink@@QEBA?AV12@XZ ?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@AEBV12@0@Z ?avx2_enabled@sse_private@mozilla@@3_NA ?avx_enabled@sse_private@mozilla@@3_NA ?ceil@Decimal@blink@@QEBA?AV12@XZ ?compareTo@Decimal@blink@@AEBA?AV12@AEBV12@@Z ?compress@LZ4@Compression@mozilla@@SA_KPEBD_KPEAD@Z ?compressLimitedOutput@LZ4@Compression@mozilla@@SA_KPEBD_KPEAD1@Z ?decompress@LZ4@Compression@mozilla@@SA_NPEBDPEAD_K@Z ?decompress@LZ4@Compression@mozilla@@SA_NPEBD_KPEAD1PEA_K@Z ?finish@SHA1Sum@mozilla@@QEAAXAEAY0BE@E@Z ?floor@Decimal@blink@@QEBA?AV12@XZ ?fromDouble@Decimal@blink@@SA?AV12@N@Z ?fromString@Decimal@blink@@SA?AV12@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A ?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A ?gTwoCharEscapes@detail@mozilla@@3QBDB ?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z ?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB ?mmx_enabled@sse_private@mozilla@@3_NA ?moz_Xbad_function_call@std@@YAXXZ ?moz_Xinvalid_argument@std@@YAXPEBD@Z ?moz_Xlength_error@std@@YAXPEBD@Z ?moz_Xout_of_range@std@@YAXPEBD@Z ?moz_Xoverflow_error@std@@YAXPEBD@Z ?moz_Xruntime_error@std@@YAXPEBD@Z ?mozalloc_abort@@YAXQEBD@Z ?mozalloc_handle_oom@@YAX_K@Z ?mozalloc_set_oom_abort_handler@@YAXP6AX_K@Z@Z ?nan@Decimal@blink@@SA?AV12@XZ ?remainder@Decimal@blink@@QEBA?AV12@AEBV12@@Z ?round@Decimal@blink@@QEBA?AV12@XZ ?sse3_enabled@sse_private@mozilla@@3_NA ?sse4_1_enabled@sse_private@mozilla@@3_NA ?sse4_2_enabled@sse_private@mozilla@@3_NA ?sse4a_enabled@sse_private@mozilla@@3_NA ?ssse3_enabled@sse_private@mozilla@@3_NA ?toDouble@Decimal@blink@@QEBANXZ ?toString@Decimal@blink@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?toString@Decimal@blink@@QEBA_NPEAD_K@Z ?update@SHA1Sum@mozilla@@QEAAXPEBXI@Z ?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z HeapAlloc HeapFree HeapReAlloc MOZ_CrashOOL MOZ_CrashPrintf _aligned_free _aligned_malloc _expand _malloc_message _malloc_options _msize _recalloc _strdup _wcsdup calloc free frex gMozCrashReason gMozillaPoisonBase gMozillaPoisonSize gMozillaPoisonValue jemalloc_free_dirty_pages jemalloc_purge_freed_pages jemalloc_stats malloc malloc_good_size malloc_usable_size mozPoisonValueInit moz_malloc_size_of moz_malloc_usable_size moz_xcalloc moz_xmalloc moz_xrealloc moz_xstrdup posix_memalign realloc strdup strndup wcsdup

Name

.text

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

332B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mozglue.dll.exe

PE Signature issue

PE Signature issue

kernel32

dbghelp

version

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic