XLBugHandler[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
XLBugHandler.dll
Size 526KB
Sample260807-kcdqlatwcs
SHA256 2d0dc8f0ac506265b19d7b384a29b85f768a788a67f0ea425735c19b56a4185f
MD5 30edc234758d72c5e2ba6ce5bedfd6a4
SHA1 201793eac1f7c0a48e3895a1e71dc05f853d0664
SHA512 2e1af1b1b4091044b6c333255909a539b91e064ba01573cb263beb301782248da5282ab9233878a2631974979225d3c0b94a9cd3fc35ac18c70d0be6968458a4
SSDEEP 12288:WV+Y9nDlq+kVneDKiJRJh3ZpA6oSE/1SgH:HinJpkuhpC6o7Us
TLSH
T1EDB46C2079C48172D9FA24B946ECB122056DB4F1472496CB1ACC0BFEE9A41D17F37B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
XLBugHandler.dll

File Explorer

XLBugHandler.dll

.dll 526KB

XLBugHandler.dll

IMPHASH 563d115a45e0367393c8deee61b0336a
SHA256 2d0dc8f0ac506265b19d7b384a29b85f768a788a67f0ea425735c19b56a4185f
MD5 30edc234758d72c5e2ba6ce5bedfd6a4
SHA1 201793eac1f7c0a48e3895a1e71dc05f853d0664
SHA512 2e1af1b1b4091044b6c333255909a539b91e064ba01573cb263beb301782248da5282ab9233878a2631974979225d3c0b94a9cd3fc35ac18c70d0be6968458a4
SSDEEP 12288:WV+Y9nDlq+kVneDKiJRJh3ZpA6oSE/1SgH:HinJpkuhpC6o7Us
TLSH
T1EDB46C2079C48172D9FA24B946ECB122056DB4F1472496CB1ACC0BFEE9A41D17F37B9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

71:f1:07:7e:22:c7:7d:fc:ff:e7:ef:d9:3a:b8:6b:2a:94:5c:da:22

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91440300746612636Q,CN=ShenZhen Thunder Networking Technologies Ltd.,OU=IT,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e5a68656e,1.3.6.1.4.1.311.60.2.1.2=#13084775616e446f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Apr 16, 2019

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

48:71:dd:fd:2e:98:d4:c3:c9:fd:c2:c8:b4:52:c6:fc

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 29, 2018 - Mar 28, 2020

Minor OS version

Major OS version

Entry point

5536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\work\sourse\XLBugReport_VS2015\bugreport\component\xl9_bugreport\bin\ReleseDll\XLBugHandler.pdb

psapi

GetModuleBaseNameW

shlwapi

PathFileExistsW PathFindFileNameW PathCombineW

kernel32

GetLastError SetErrorMode EnterCriticalSection LeaveCriticalSection GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThread GetCurrentThreadId GetSystemTime GetVersionExW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW SetUnhandledExceptionFilter MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects SetLastError VirtualQueryEx ReadProcessMemory GetThreadSelectorEntry VirtualQuery InterlockedCompareExchange VirtualProtect ResumeThread FlushInstructionCache SetThreadContext GetThreadContext VirtualFree SuspendThread VirtualAlloc CloseHandle CreateFileW ReadFile ReadConsoleW OutputDebugStringA OutputDebugStringW FreeEnvironmentStringsW SystemTimeToTzSpecificLocalTime DecodePointer SetEndOfFile HeapReAlloc HeapSize WriteConsoleW SetFilePointerEx SetStdHandle FlushFileBuffers SetConsoleCtrlHandler GetProcessHeap GetEnvironmentStringsW SetEnvironmentVariableW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList EncodePointer CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType GetACP GetStringTypeW GetTimeZoneInformation WriteFile GetConsoleCP GetConsoleMode FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW SetEnvironmentVariableA

advapi32

GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegQueryValueExW RegOpenKeyW RegCloseKey TraceEvent GetTraceEnableLevel

shell32

ShellExecuteW SHCreateDirectoryExW

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

424KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XLBugHandler.dll

PE Signature issue

psapi

shlwapi

kernel32

advapi32

shell32

wininet

version

generic