mvMeter2[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mvMeter2.dll
Size 8.2MB
Sample260916-va6cyabg33
SHA256 2b15f0e2f99d0d990db5c3ca939850affd4ae8054a20866d97219c050c1b5568
MD5 e81b6e48a91b17276bb292455bdbcc6f
SHA1 a677538bea5f9dda58289bb11ce00d3b0fe2758d
SHA512 c1efaf5cb13b1bd11c3085fca8ac17e1c4c448a7866f8bbcd8e4d375342e80e277b7f037f9adba81514e44c1ff0e64e5a562e984258b9abcbbfaa11afbcb1b76
SSDEEP 196608:yIdjenXQlO/HNtCQzQNvl/wuUIewtk/uJf6/j2Ql/0r+MCL:3flAQZI9wng0r4
TLSH
T180860287F3D885E5F076A13490AB6B0BE7B4B4061B3595DB12A0467E6F233E06F3A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
mvMeter2.dll

File Explorer

mvMeter2.dll

.dll 8.2MB

mvMeter2.dll

IMPHASH c3eb0ddc9655fc1f1310dd4f0cd33ec8
SHA256 2b15f0e2f99d0d990db5c3ca939850affd4ae8054a20866d97219c050c1b5568
MD5 e81b6e48a91b17276bb292455bdbcc6f
SHA1 a677538bea5f9dda58289bb11ce00d3b0fe2758d
SHA512 c1efaf5cb13b1bd11c3085fca8ac17e1c4c448a7866f8bbcd8e4d375342e80e277b7f037f9adba81514e44c1ff0e64e5a562e984258b9abcbbfaa11afbcb1b76
SSDEEP 196608:yIdjenXQlO/HNtCQzQNvl/wuUIewtk/uJf6/j2Ql/0r+MCL:3flAQZI9wng0r4
TLSH
T180860287F3D885E5F076A13490AB6B0BE7B4B4061B3595DB12A0467E6F233E06F3A750
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

c5:92:f9:e0:9a:7b:68:da:f6:db:f7:87:cd:b3:15:cf:b0:7c:cc:cf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=TBProAudio,OU=IT,O=TBProAudio,POSTALCODE=85551,STREET=Ammerseestrasse 9,L=Kirchheim b. München,ST=Bayern,C=DE

Chains

May 5, 2021

CN=TBProAudio,OU=IT,O=TBProAudio,POSTALCODE=85551,STREET=Ammerseestrasse 9,L=Kirchheim b. München,ST=Bayern,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=TBProAudio,OU=IT,O=TBProAudio,POSTALCODE=85551,STREET=Ammerseestrasse 9,L=Kirchheim b. München,ST=Bayern,C=DE

Serial Number

36:a4:72:71:2d:50:36:62:29:ae:ca:5f:23:06:11:79

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 6, 2020 - Mar 6, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

500592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\source\vst1\iPlug2_work\MyWork\mvMeter2\build-win\pdbs\mvMeter2-vst2_x64.pdb

wininet

InternetGetConnectedState

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsA

kernel32

LoadLibraryW CloseHandle GlobalAlloc LoadLibraryA GetCurrentThread CreateFileA UnmapViewOfFile GetSystemDirectoryW WaitForSingleObject SetThreadPriority DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection FindClose WriteConsoleW HeapSize SetEndOfFile GetFileAttributesExW Sleep GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA CreateThread GetACP IsValidCodePage SetStdHandle GetCurrentDirectoryW GetConsoleCP WriteFile GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW GetConsoleMode HeapAlloc HeapFree HeapReAlloc SetFilePointerEx FreeLibraryAndExitThread ExitThread GetModuleFileNameW GetModuleHandleExW ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetProcAddress GlobalLock CreateFileMappingA GetFileSize VerSetConditionMask GetCurrentProcessId FreeLibrary WideCharToMultiByte FindNextFileW GetFullPathNameW FindFirstFileExW CreateDirectoryW LoadResource LockResource FindResourceA EnumResourceNamesA SizeofResource GlobalUnlock GetTickCount MapViewOfFile GetOEMCP VerifyVersionInfoW FlushFileBuffers MultiByteToWideChar RtlUnwind GetFileInformationByHandle GetDriveTypeW CreateFileW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx GetFileSizeEx VerifyVersionInfoA WaitForMultipleObjects PeekNamedPipe ReadFile InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead QueryPerformanceFrequency InitializeCriticalSectionEx EncodePointer DecodePointer DeleteFileW LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo GetLastError SetLastError FormatMessageW SleepEx GetSystemDirectoryA GetModuleHandleA MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType

user32

ToAscii EndPaint VkKeyScanExA GetKeyboardLayout GetKeyState GetMessageExtraInfo GetUpdateRgn CloseTouchInputHandle GetTouchInputInfo GetWindowRect LoadCursorA DestroyWindow GetDC SetWindowPos PostMessageA CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics CreatePopupMenu TrackPopupMenu GetKeyboardState OpenClipboard RegisterWindowMessageA GetCapture SetTimer RegisterTouchWindow ClientToScreen CloseClipboard CallWindowProcA EmptyClipboard GetWindowLongA ValidateRect GetDoubleClickTime TrackMouseEvent SetWindowTextA MessageBoxA RegisterClassA GetMessageTime DefWindowProcA DestroyMenu CreateWindowExA SetFocus GetClipboardData SendMessageA SetCapture SetClipboardData SetCursor AppendMenuA PeekMessageA IsClipboardFormatAvailable GetWindowLongPtrA UnregisterClassA BeginPaint GetCursorPos ReleaseDC SetCursorPos GetAncestor InvalidateRect ShowCursor ReleaseCapture UpdateWindow SetWindowLongPtrA GetParent KillTimer

gdi32

AddFontMemResourceEx SelectObject CreateCompatibleDC GetStockObject EnumFontFamiliesExA GetTextFaceA CreateRectRgn DeleteDC SetTextColor GetFontData ChoosePixelFormat GetRegionData SetBkMode SetDCBrushColor CreateFontIndirectA SetBkColor DeleteObject RemoveFontMemResourceEx SwapBuffers GetRgnBox GetObjectA SetPixelFormat

comdlg32

ChooseColorA GetOpenFileNameW GetSaveFileNameW

shell32

DragAcceptFiles ShellExecuteW DragQueryPoint DragQueryFileA SHGetFolderPathW SHGetPathFromIDListA SHBrowseForFolderA

ole32

OleInitialize OleUninitialize CoTaskMemFree

opengl32

wglMakeCurrent wglDeleteContext wglCreateContext wglGetCurrentDC wglGetCurrentContext

advapi32

CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptAcquireContextA CryptCreateHash CryptGetHashParam CryptGenRandom

ws2_32

ntohl gethostname sendto recvfrom WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send recv closesocket WSAIoctl WSASetLastError

wldap32

ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mvMeter2.dll

wininet

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

shell32

ole32

opengl32

advapi32

ws2_32

wldap32

crypt32

generic