roxentec-h[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
roxentec-h.dll
Size 392KB
Sample260903-261kwstyay
SHA256 3479a440d2696a176ff2cf3afeca5ada17381776c0781d8f74c8c5c508c720ff
MD5 024e9be87aef2f09c2fcee3c8f30b2af
SHA1 841d95731ec530a4eaa0a9f539180d09b95b9741
SHA512 4851ae5f90dddf92c4c7fc842379d0c504da84578aa64ab4e6474dc977c8f9df779b16519c1e514fda0671e86e4d2685f8336f8396801da51f7eac81b57a6ea2
SSDEEP 6144:u5AR8L/hTa320SABAdxj+gYSG28Zn74Qpo:ZP0y2G28Znk
TLSH
T1B6848D1AE9A604B9D1A3D578C9735502EA327C4E07609ADB23E40A991F3BFE05B3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
roxentec-h.dll

File Explorer

roxentec-h.dll

.dll 392KB

roxentec-h.dll

IMPHASH 8ad14e6226939d9bd94f7171d3d7d091
SHA256 3479a440d2696a176ff2cf3afeca5ada17381776c0781d8f74c8c5c508c720ff
MD5 024e9be87aef2f09c2fcee3c8f30b2af
SHA1 841d95731ec530a4eaa0a9f539180d09b95b9741
SHA512 4851ae5f90dddf92c4c7fc842379d0c504da84578aa64ab4e6474dc977c8f9df779b16519c1e514fda0671e86e4d2685f8336f8396801da51f7eac81b57a6ea2
SSDEEP 6144:u5AR8L/hTa320SABAdxj+gYSG28Zn74Qpo:ZP0y2G28Znk
TLSH
T1B6848D1AE9A604B9D1A3D578C9735502EA327C4E07609ADB23E40A991F3BFE05B3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2f:21:01:a1:13:4e:52:cf:aa:43:d3:db:83:c9:e3:fe:49:bc:bb:71:0c:66:d2:79:6a:64:7a:e9:70:82:c4:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN

Chains

Sep 2, 2026

CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN

Subject

CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN

Serial Number

28:77:79:fb:66:62:61:cb:73:17:47:92:9a:62:17:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2017 - Oct 13, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

110796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

Beep VirtualQuery GetTickCount64 WideCharToMultiByte SetEndOfFile WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc DisableThreadLibraryCalls VirtualAlloc GetModuleHandleExW SetStdHandle VirtualProtect MultiByteToWideChar FormatMessageA GetStringTypeW LocalFree GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleFileNameW HeapAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode HeapFree GetFileSizeEx SetFilePointerEx GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW RtlUnwind

user32

GetSystemMetrics GetAsyncKeyState MessageBoxA GetCursorPos CallNextHookEx

Name

.text

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

roxentec-h.dll

PE Signature issue

kernel32

user32

generic