Real_version-ddf02245bdbb428c[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Real_version-ddf02245bdbb428c.dll
Size 2.8MB
Sample260723-cjw7hszbmc
SHA256 8e38f610f152082554c734198149d436b97d943466e42debc9f5f444784742d8
MD5 4e93bc0dad0abe1e010610c87a700b74
SHA1 8a15fa6c6437802144623c59cf2bb94ddb6e847f
SHA512 19d1c52b7115e1a430b31e92414ac89263b10a8633082ef0c4f9c593e1948414eb5dfae36dca612da44232f235d221b40bccb8ceb589cbb19c38d92f55a6304a
SSDEEP 49152:X3CtADKwFPaghoMs0qgIpWKBshp86CTYI8o/NxU/9E5TNiC0h/1LQRxdNGjSXeKB:X3CT90xdpEYA1K/S0h/1LQRxdN5B
TLSH
T1E6D59E56B66400A9D067C1B8C6974A03E7F2BC4413309BEF16A4EE662F73BE55B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Real_version-ddf02245bdbb428c.dll

File Explorer

Real_version-ddf02245bdbb428c.dll

.dll 2.8MB

Real_version-ddf02245bdbb428c.dll

IMPHASH 5fc5b356ed4ae4cb993f057c0eca4e56
SHA256 8e38f610f152082554c734198149d436b97d943466e42debc9f5f444784742d8
MD5 4e93bc0dad0abe1e010610c87a700b74
SHA1 8a15fa6c6437802144623c59cf2bb94ddb6e847f
SHA512 19d1c52b7115e1a430b31e92414ac89263b10a8633082ef0c4f9c593e1948414eb5dfae36dca612da44232f235d221b40bccb8ceb589cbb19c38d92f55a6304a
SSDEEP 49152:X3CtADKwFPaghoMs0qgIpWKBshp86CTYI8o/NxU/9E5TNiC0h/1LQRxdNGjSXeKB:X3CT90xdpEYA1K/S0h/1LQRxdN5B
TLSH
T1E6D59E56B66400A9D067C1B8C6974A03E7F2BC4413309BEF16A4EE662F73BE55B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d2:9a:96:03:a3:00:75:a0:eb:72:87:24:52:8f:9f:2f:49:a6:6e:09

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Chains

Apr 7, 2016

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Subject

CN=viper,O=take2games,L=San Francisco,ST=California,C=US,1.2.840.113549.1.9.1=#0c18436f707972696768744074616b653267616d65732e636f6d

Serial Number

03:e8

Issuer

CN=viper,O=take2games,L=San Francisco,ST=California,C=US,1.2.840.113549.1.9.1=#0c18436f707972696768744074616b653267616d65732e636f6d

Timespan

Jan 27, 2025 - Jan 27, 2026

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Serial Number

69:50:43:d6:8f:15:55:0f:d5:db:37:0f:a8:81:7b:04

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2011 - Sep 20, 2013

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1954864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Deni\source\repos\Real\Build\bin\Real.pdb

kernel32

WideCharToMultiByte GetProcAddress VerSetConditionMask MultiByteToWideChar GlobalLock CreateThread GlobalFree GlobalAlloc AllocConsole SetConsoleCursorPosition FillConsoleOutputAttribute FreeConsole GetStdHandle SetConsoleTitleA SetConsoleTextAttribute GetConsoleScreenBufferInfo FillConsoleOutputCharacterA VirtualQuery GetSystemTimeAsFileTime Sleep GetModuleHandleA GetSystemTimePreciseAsFileTime SetLastError GetLastError QueryPerformanceFrequency QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection GetConsoleWindow GlobalUnlock

user32

EnumWindows MessageBoxA GetSystemMetrics GetClassNameA MapVirtualKeyA mouse_event IsWindow GetWindowThreadProcessId keybd_event ShowWindow RegisterClipboardFormatA SetClipboardData EmptyClipboard CloseClipboard GetForegroundWindow ClientToScreen OpenClipboard GetClientRect

advapi32

CryptGenRandom CryptAcquireContextA GetCurrentHwProfileA CryptReleaseContext

msvcp140

_Thrd_hardware_concurrency ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ __crtLCMapStringA ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?_Xbad_alloc@std@@YAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??Bios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z _Query_perf_frequency _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx DeleteCriticalSection AcquireSRWLockExclusive WaitForSingleObjectEx SleepEx ReleaseSRWLockExclusive

api-ms-win-core-file-l1-1-0

GetFullPathNameW FindFirstFileW CreateFileW CreateDirectoryW GetFileType ReadFile FindNextFileW FindFirstFileExW GetFileSizeEx SetFileInformationByHandle GetFileAttributesExW GetFileInformationByHandle FindClose GetFinalPathNameByHandleW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx CopyFile2 MoveFileExW

ws2_32

WSAStartup ntohs WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAIoctl WSASetLastError gethostname __WSAFDIsSet setsockopt send recv htons getsockopt getsockname getpeername connect closesocket bind WSACleanup select listen recvfrom sendto ioctlsocket freeaddrinfo getaddrinfo socket htonl accept WSAGetLastError WSAWaitForMultipleEvents

iphlpapi

if_nametoindex

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-security-cryptoapi-l1-1-0

CryptGetHashParam CryptAcquireContextW CryptDestroyHash CryptCreateHash CryptHashData

crypt32

CryptStringToBinaryW PFXImportCertStore CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertFreeCertificateChainEngine CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA GetCurrentDirectoryW

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

sspicli

InitSecurityInterfaceW

api-ms-win-core-synch-l1-2-0

WakeConditionVariable InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx FormatMessageA

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wininet

HttpOpenRequestA InternetOpenUrlA InternetSetOptionA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetCrackUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __current_exception_context __current_exception __std_type_info_destroy_list wcschr strrchr __std_terminate __std_type_info_name _purecall __std_type_info_compare __std_exception_copy memcpy __std_exception_destroy __RTtypeid __RTDynamicCast __C_specific_handler memchr _CxxThrowException memset memmove strchr strstr

api-ms-win-crt-runtime-l1-1-0

_errno _invalid_parameter_noinfo _beginthreadex terminate _initterm_e _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll abort strerror_s

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh calloc free

api-ms-win-crt-string-l1-1-0

strlen isdigit _strnicmp _stricmp wcslen isalnum toupper strncat isspace strcspn strspn strcmp _strdup wcscpy_s wcsncpy_s tolower wcsncmp isalpha strncmp strpbrk

api-ms-win-crt-time-l1-1-0

strftime _time64 _gmtime64_s

api-ms-win-crt-stdio-l1-1-0

_fileno fputs fputc _close fgets fflush _read _write _lseeki64 fclose fgetc fwrite fgetpos setvbuf ungetc fsetpos _wfsopen _wsopen_s fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vsprintf feof ferror __acrt_iob_func freopen_s __stdio_common_vfprintf fseek ftell

api-ms-win-crt-filesystem-l1-1-0

_fullpath _unlink _fstat64 _unlock_file _lock_file _wstat64

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoull atoi strtoul strtoll

api-ms-win-crt-math-l1-1-0

sin ldexp round _dsign ceil log2 cosh atan2 sinh sqrt sqrtf exp tanh tan cos atan log10 floorf log fmod asin frexp _fdopen acos pow _fdsign _ldsign llround modf ceilf floor

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___lc_locale_name_func ___lc_collate_cp_func

Sharing

General

Malware Config

Signatures

File Explorer

Real_version-ddf02245bdbb428c.dll

PE Signature issue

kernel32

user32

advapi32

msvcp140

bcrypt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

ws2_32

iphlpapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-cryptoapi-l1-1-0

crypt32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-1

sspicli

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-interlocked-l1-1-0

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic