WSUtils.dll.f225c982653af37f21688aea804c9097.gzip
- SHA256 d48cedbfe95ac69fd1b57f75ece7ea82e4db04ceefb6243c7be2f7ce24482b11
Static task
static1
Behavioral task
behavioral1
Sample
WSUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
WSUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target WSUtils.dll.f225c982653af37f21688aea804c9097.gzip
- Size 166KB
- Sample260722-phb66s1thy
- SHA256 d48cedbfe95ac69fd1b57f75ece7ea82e4db04ceefb6243c7be2f7ce24482b11
- MD5 ed13fb69a13be722d1ac383282ea81ed
- SHA1 96540c08959cb04c92b603474dfc43a3975656b2
- SHA512 85168f346b73ebf63085895cf62a5048025d4fc0e91350dc43a41598a8ab44dbb0136c012f0aa2c3c31a7514f94795fb8b662aac63c337f7513fe325bf1b0bff
- SSDEEP 3072:YqjtJfSnDpozHLMwx3B5VUT8GeNGgNWourCz/Q9BcxWbFhZvdA3JxEDb5+B:H70QHwyB5VUCNf22fsbFhM/W1+B
- TLSH T18FF323BCB402D6D36CD0BF7FA9EACB35F2700255BA456E33A04BD5AE62102D78A24D10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
WSUtils.dll.f225c982653af37f21688aea804c9097.gzip.gz 166KB
-
WSUtils.dll.dll 297KB
WSUtils.dll
- IMPHASH 789abd1ca110ce195fa4d8e18b2e88c3
- SHA256 83b5c1251d7f57665117a1a848eb3c3201938b3c4d299cb20a5b92d3d068c87f
- MD5 f225c982653af37f21688aea804c9097
- SHA1 97e48f205e7b8f5aa619e241de236d7a4f7754a3
- SHA512 15345c960eec3ba9530e3014075069eb549dddfc490423825e7b70f18923cdb55127c7ee55f4de327e7e28b12f53d51242e24ca65625c64fab3974a5ff0b8dc5
- SSDEEP 6144:2kdjHoajzq8Q8lSnnhcVOSlIt0rWQ8XQAfSkqFcn4lGLgtyxt2e:2kdbjjzrlOhcl00rWwuq6n4AqE2e
- TLSH T127549E12F5C0C072D4AE143156B8CBB55ABDB8304BA4E8CFE3D8297D5E216C2A73965F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
37:6b:e1:a7:bd:f4:11:d3:42:2a:ed:d6:80:cf:09:62:9d:6b:dd:51:fe:bb:59:0a:4d:48:cf:ed:ad:53:81:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
Chains
Jul 13, 2026
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Bitdefender SRL,OU=DEVSUP EPS,O=Bitdefender SRL,L=Bucuresti,C=RO
Serial Number
0e:a1:9c:ac:95:5e:12:46:85:a1:d8:fc:bc:4c:c3:05
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 20, 2026 - May 9, 2029
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
89902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\httplibs\bin\win32\release\WSUtils.pdb
rpcrt4
UuidCreate
netapi32
NetApiBufferFree
NetGetJoinInformation
kernel32
FindNextFileA
FindNextFileW
FlushFileBuffers
ReadFile
WriteFile
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
FindFirstFileW
OutputDebugStringA
OutputDebugStringW
CreateFileA
DeviceIoControl
GetVersion
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
GetStringTypeW
FindFirstFileA
FindClose
CreateFileW
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
GetFileSize
InitializeSListHead
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCurrentDirectoryW
SetEndOfFile
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileTime
GetFullPathNameW
GetFullPathNameA
LocalFileTimeToFileTime
SetFileTime
DosDateTimeToFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DecodePointer
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
DuplicateHandle
SetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetConsoleOutputCP
HeapAlloc
HeapFree
GetStdHandle
GetFileSizeEx
CompareStringW
LCMapStringW
advapi32
RegQueryValueExA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExA
ole32
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
oleaut32
VariantChangeType
VariantCopy
VariantClear
SysStringLen
SysFreeString
SysAllocString
VariantInit
WSUtilConvertUnicode
WSUtilConvertUtf8
WSUtilConvertUtf8ToURLSafe
WSUtilConvertionUnicodeToUtf8
WSUtilConvertionUtf8ToUnicode
WSUtilEmailValid
WSUtilExtractZipA
WSUtilExtractZipW
WSUtilGetComputerDescription
WSUtilGetComputerFullName
WSUtilGetIDs
WSUtilGetUID
WSUtilGetUID2
WSUtilIDSetDebug
WSUtilMD5BufferToInt
WSUtilMD5BufferToStr
WSUtilMD5FdToInt
WSUtilMD5FdToStr
WSUtilMD5FileToIntA
WSUtilMD5FileToIntW
WSUtilMD5FileToIntWA
WSUtilMD5FileToStrA
WSUtilMD5FileToStrW
WSUtilMD5FileToStrWA
WSUtilMD5GzFdToInt
WSUtilMD5GzFdToStr
WSUtilMD5GzFileToIntA
WSUtilMD5GzFileToIntW
WSUtilMD5GzFileToStrA
WSUtilMD5GzFileToStrW
WSUtilMD5GzFileToStrWA
WSUtilMyDirCopyDirA
WSUtilMyDirCopyDirExW
WSUtilMyDirCopyDirW
WSUtilMyDirCopyFileA
WSUtilMyDirCopyFileExW
WSUtilMyDirCopyFileW
WSUtilMyDirDeleteDirA
WSUtilMyDirDeleteDirW
WSUtilMyDirEnumDirA
WSUtilMyDirEnumDirW
WSUtilMyDirFileExistsA
WSUtilMyDirFileExistsW
WSUtilMyDirPreserveAttributesA
WSUtilMyDirPreserveAttributesW
WSUtilResetUID
WSUtilZipFileAddA
WSUtilZipFileAddW
WSUtilZipFileClose
WSUtilZipFileCreateA
WSUtilZipFileCreateW
WSUtilZipFileQuickAddA
WSUtilZipFileQuickAddW
WSUtilZlibGunzip
WSUtilZlibGunzipFileA
WSUtilZlibGunzipFileW
WSUtilZlibGzip
WSUtilZlibGzipFd
WSUtilZlibGzipFileA
WSUtilZlibGzipFileW
WSUtilsGetProxyAuth
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=184, id=261, version=30795,
count=8, id=253, version=28518,
count=16, id=260, version=30034,
count=21, id=259, version=30034,
count=40, id=261, version=30034,
count=24, id=260, version=30795,
count=141, id=1, productName=Unmarked objects,
count=13, id=257, version=30795,
count=20, id=260, version=30159,
count=17, id=261, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,