version[.]dll | Triage™

General

Target
version.dll
Size 571KB
Sample260928-yej72ssbpc
SHA256 30001bfbd02b7c203362cef6725f4aa13ded3612a158fc5591c829975871a413
MD5 11917af5d4111a63d7dbe8128d086e42
SHA1 179dd8d31afb7933a96aeaf41fda9c283f1a5b44
SHA512 4de707cd15c16e404215f72aaa87223ffb618ecf2a9312dfc33660def08a8b5efecd0fe1c3e2939802475f1b4ac4a2993cbfb5194c1c3b8b91083e1c2a4a41b9
SSDEEP 12288:ameXB8Kh4YT+WfxBuKLs70Y/mjWWiih1bJp:aXR8Kh4YRDuKgoYeOih1lp
TLSH
T130C45A85E5A24EBFC106C370C23568BDF16F7F5A4D34995BBF4ABA506F72504C83AA20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
version.dll

File Explorer

version.dll

.dll 571KB

version.dll

IMPHASH 299685874308a06857223bc730131182
SHA256 30001bfbd02b7c203362cef6725f4aa13ded3612a158fc5591c829975871a413
MD5 11917af5d4111a63d7dbe8128d086e42
SHA1 179dd8d31afb7933a96aeaf41fda9c283f1a5b44
SHA512 4de707cd15c16e404215f72aaa87223ffb618ecf2a9312dfc33660def08a8b5efecd0fe1c3e2939802475f1b4ac4a2993cbfb5194c1c3b8b91083e1c2a4a41b9
SSDEEP 12288:ameXB8Kh4YT+WfxBuKLs70Y/mjWWiih1bJp:aXR8Kh4YRDuKgoYeOih1lp
TLSH
T130C45A85E5A24EBFC106C370C23568BDF16F7F5A4D34995BBF4ABA506F72504C83AA20
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bc:ab:4d:5a:0e:de:82:cb:ee:0b:93:34:c0:a6:fb:c9:6e:7a:bc:e2:4a:81:b3:2f:99:37:40:fb:9d:4a:52:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Anti Denuvo Sanctuary

Chains

Sep 23, 2026

CN=Anti Denuvo Sanctuary

Subject

CN=Anti Denuvo Sanctuary

Serial Number

17:10:b5:18:73:0d:2b:b5:48:a4:59:56:54:5a:d1:16

Issuer

CN=Anti Denuvo Sanctuary

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 6, 2026 - Jan 6, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

46020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

Thread32Next Thread32First GetCurrentProcessId OpenThread CreateToolhelp32Snapshot AddVectoredExceptionHandler CloseHandle FreeLibrary SuspendThread GetModuleFileNameW GetThreadContext ResumeThread GetModuleHandleA GetCurrentThread GetSystemDirectoryA LoadLibraryA GetProcAddress SetThreadContext IsProcessorFeaturePresent TerminateProcess WaitForSingleObject SetLastError HeapAlloc HeapReAlloc FormatMessageW GetModuleHandleW HeapFree GetProcessHeap GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter VirtualQuery VirtualFree VirtualAlloc GetSystemInfo VirtualProtect FlushInstructionCache GetCurrentProcess Sleep QueryPerformanceCounter HeapCreate GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtReadFile

vcruntime140

memcpy memcmp memset __C_specific_handler __std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _seh_filter_dll _initterm _initialize_narrow_environment _initialize_onexit_table _execute_onexit_table _cexit _initterm_e

CloseDriver DefDriverProc DllMain DriverCallback DrvGetModuleHandle GetDriverModuleHandle GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW WOWAppExit auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion sndPlaySoundA sndPlaySoundW timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite

Name

.text

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ads0

Size

495KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version.dll

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

generic