wsutils.dll.03bc020b9f51f30cb644eb32039c1ddc.gzip
- SHA256 1e064bb5633b423ac2c9855f84226801812e1526ae9dd4546d9f96782eef285a
Static task
static1
Behavioral task
behavioral1
Sample
wsutils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
wsutils.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target wsutils.dll.03bc020b9f51f30cb644eb32039c1ddc.gzip
- Size 166KB
- Sample260623-pdmgcacx4x
- SHA256 1e064bb5633b423ac2c9855f84226801812e1526ae9dd4546d9f96782eef285a
- MD5 db3f5bf8b43dc38923983130d6c88a1a
- SHA1 f26ce262d1f05ed89beb645253d9b175582f420d
- SHA512 634e1b577c13fe7f4d0c4fde8c7b94ce03ccf7fd6b412c018c789bf815bab317d6d747dc445e3178f71df36485cc53a56d857228dc72ec6968a0d9a128c1211d
- SSDEEP 3072:RoggomfqKUeFgKYhnSghkws56zHBHtMmY1zFd9IBiOZ:higdSgywI6zNtg/I9
- TLSH T16CF313534F43533DF144FB2381ACED582138586DA2E0F3ADA1D93BBD698847C62AE275
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
wsutils.dll.03bc020b9f51f30cb644eb32039c1ddc.gzip.gz 166KB
-
wsutils.dll.dll 297KB
wsutils.dll
- IMPHASH 789abd1ca110ce195fa4d8e18b2e88c3
- SHA256 dfbfcad9660a66d0323da2a0504c5f4b080b0a363fdd12ee092111abe2ea5997
- MD5 03bc020b9f51f30cb644eb32039c1ddc
- SHA1 45954b056bab5fae83128794350e3ab9d511dd7f
- SHA512 8b6ff9826c0ff520a1982305cef83c54aee1c1b99d8c4042d697c3f226686fe4af708e6a6f78b27f3c5583152a434970d63e4098ee1b4d5cac3e2b3dad4b0873
- SSDEEP 6144:YMdjHoajzqkQ8lSnn39QGSeQt0DeQzXQQfSkDPn4gLgtyt32N:YMdbjjzDlO39x80DeL+DPn4gqK2N
- TLSH T143549E12F5C0C072E4AE143156B8CBB55ABDB8304B94E8CFE3D829795E216C2A73975F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e0:52:94:0f:9e:60:97:3f:10:c5:07:b6:17:15:15:ae:02:ba:26:78:aa:7e:bf:dc:fe:cb:7b:ae:2f:9e:e2:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
Chains
Jun 4, 2026
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
Serial Number
0e:a1:9c:ac:95:5e:12:46:85:a1:d8:fc:bc:4c:c3:05
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 20, 2026 - May 9, 2029
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
89902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\Bamboo\home\xml-data\build-dir\OEMSDK-HTTPLIBS-SOURCES\bin\win32\release\WSUtils.pdb
rpcrt4
UuidCreate
netapi32
NetApiBufferFree
NetGetJoinInformation
kernel32
FindNextFileA
FindNextFileW
FlushFileBuffers
ReadFile
WriteFile
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
FindFirstFileW
OutputDebugStringA
OutputDebugStringW
CreateFileA
DeviceIoControl
GetVersion
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
GetStringTypeW
FindFirstFileA
FindClose
CreateFileW
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
GetFileSize
InitializeSListHead
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCurrentDirectoryW
SetEndOfFile
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileTime
GetFullPathNameW
GetFullPathNameA
LocalFileTimeToFileTime
SetFileTime
DosDateTimeToFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DecodePointer
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
DuplicateHandle
SetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetConsoleOutputCP
HeapAlloc
HeapFree
GetStdHandle
GetFileSizeEx
CompareStringW
LCMapStringW
advapi32
RegQueryValueExA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExA
ole32
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
oleaut32
VariantChangeType
VariantCopy
VariantClear
SysStringLen
SysFreeString
SysAllocString
VariantInit
WSUtilConvertUnicode
WSUtilConvertUtf8
WSUtilConvertUtf8ToURLSafe
WSUtilConvertionUnicodeToUtf8
WSUtilConvertionUtf8ToUnicode
WSUtilEmailValid
WSUtilExtractZipA
WSUtilExtractZipW
WSUtilGetComputerDescription
WSUtilGetComputerFullName
WSUtilGetIDs
WSUtilGetUID
WSUtilGetUID2
WSUtilIDSetDebug
WSUtilMD5BufferToInt
WSUtilMD5BufferToStr
WSUtilMD5FdToInt
WSUtilMD5FdToStr
WSUtilMD5FileToIntA
WSUtilMD5FileToIntW
WSUtilMD5FileToIntWA
WSUtilMD5FileToStrA
WSUtilMD5FileToStrW
WSUtilMD5FileToStrWA
WSUtilMD5GzFdToInt
WSUtilMD5GzFdToStr
WSUtilMD5GzFileToIntA
WSUtilMD5GzFileToIntW
WSUtilMD5GzFileToStrA
WSUtilMD5GzFileToStrW
WSUtilMD5GzFileToStrWA
WSUtilMyDirCopyDirA
WSUtilMyDirCopyDirExW
WSUtilMyDirCopyDirW
WSUtilMyDirCopyFileA
WSUtilMyDirCopyFileExW
WSUtilMyDirCopyFileW
WSUtilMyDirDeleteDirA
WSUtilMyDirDeleteDirW
WSUtilMyDirEnumDirA
WSUtilMyDirEnumDirW
WSUtilMyDirFileExistsA
WSUtilMyDirFileExistsW
WSUtilMyDirPreserveAttributesA
WSUtilMyDirPreserveAttributesW
WSUtilResetUID
WSUtilZipFileAddA
WSUtilZipFileAddW
WSUtilZipFileClose
WSUtilZipFileCreateA
WSUtilZipFileCreateW
WSUtilZipFileQuickAddA
WSUtilZipFileQuickAddW
WSUtilZlibGunzip
WSUtilZlibGunzipFileA
WSUtilZlibGunzipFileW
WSUtilZlibGzip
WSUtilZlibGzipFd
WSUtilZlibGzipFileA
WSUtilZlibGzipFileW
WSUtilsGetProxyAuth
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=184, id=261, version=30795,
count=8, id=253, version=28518,
count=16, id=260, version=30034,
count=21, id=259, version=30034,
count=8, id=260, version=30154,
count=40, id=261, version=30034,
count=24, id=260, version=30795,
count=141, id=1, productName=Unmarked objects,
count=13, id=257, version=30795,
count=12, id=260, version=30159,
count=17, id=261, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,