_ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
_ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0.dll
Size 2.3MB
Sample260620-ma9rcset3k
SHA256 ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0
MD5 1bb63e08cd7ea35710113c7c4c850780
SHA1 c5bca081172cbe8ca0e273adcabc344f5abd8780
SHA512 3cc8fe398dd8236f2a8f5b3e3d34b30be802621b33fe0bf73e5765a6e1180ce37fe258f461980171f7a82cf0cb49f8bb427ac400da782251f5791debeb3dcc2c
SSDEEP 49152:iQLVR8jNIMAW5Oo+TxjV3HMLvoZ5kQM8LdwWv:i5iWC3HMjS53RL1v
TLSH
T1ACB55B0BBCE1C8B4D0AB9235896651A27A31BE041F3163DF2A50B3792FB77D09A75770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
_ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0.dll

File Explorer

_ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0.dll

.dll 2.3MB

_ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0.dll

IMPHASH ae7b0dcd0acb9c3fb756997398347299
SHA256 ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0
MD5 1bb63e08cd7ea35710113c7c4c850780
SHA1 c5bca081172cbe8ca0e273adcabc344f5abd8780
SHA512 3cc8fe398dd8236f2a8f5b3e3d34b30be802621b33fe0bf73e5765a6e1180ce37fe258f461980171f7a82cf0cb49f8bb427ac400da782251f5791debeb3dcc2c
SSDEEP 49152:iQLVR8jNIMAW5Oo+TxjV3HMLvoZ5kQM8LdwWv:i5iWC3HMjS53RL1v
TLSH
T1ACB55B0BBCE1C8B4D0AB9235896651A27A31BE041F3163DF2A50B3792FB77D09A75770
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

07:db:60:07:1f:f5:52:55:df:f0:26:cd:44:fd:e8:35:75:51:1c:75:38:af:bc:0e:de:09:63:36:b7:c7:f9:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ultra Hub,OU=Application Services,O=Coreline Dynamics Corp.,L=Denver,ST=CO,C=US

Chains

Jun 8, 2026

CN=Ultra Hub,OU=Application Services,O=Coreline Dynamics Corp.,L=Denver,ST=CO,C=US

Subject

CN=Ultra Hub,OU=Application Services,O=Coreline Dynamics Corp.,L=Denver,ST=CO,C=US

Serial Number

12:2e:3b:82:81:94:5e:ad:4a:0f:c4:36:dd:fe:9a:dd

Issuer

CN=Ultra Hub,OU=Application Services,O=Coreline Dynamics Corp.,L=Denver,ST=CO,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 8, 2026 - Jun 8, 2031

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4754

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateThread CreateWaitableTimerExW DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW PostQueuedCompletionStatus RaiseFailFastException ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WriteConsoleW WriteFile

ucrtbase

__acrt_iob_func __daylight __p___argc __p___argv __p___wargv __p__environ __p__wenviron __stdio_common_vfprintf __stdio_common_vfwprintf __timezone __tzname _beginthread _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _execute_onexit_table _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _register_onexit_function _set_new_mode _stricmp _tzset abort calloc free fwrite malloc memcpy strcmp strlen strncmp

Name

.text

Size

846KB

Virtual Size

845KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_ce1c89758c10c76581dd5c9d6ea0fb4f84b88ad927d021b81bbe050a2db402c0.dll

PE Signature issue

kernel32

ucrtbase

generic