e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a[.]dll

General

Target
e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a.dll
Size 280KB
Sample261005-vptyfsybph
SHA256 e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a
MD5 376064351308815baa1cedb83e67b356
SHA1 f0e8d7c1b16adbb734d5254e70b3f6f5f616b09b
SHA512 d2e83c2e97a11f22041a5936259829ba465098f8db501fe980b90829f43132cc31d29a50abbae1d4cce2693eff837b00643489a61afe29592d65b65bf177f8fa
SSDEEP 6144:k+J6EWI9FatwUCLTlNy03xW3kLi7GfQpCsf2UAW:N6PeFatCLTlNy0hji7mZe2rW
TLSH
T1CF548C22E3954470F27B0A315077D1638BBDBA508BB48DD7639A202D3DA37F1A934B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a.dll

File Explorer

e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a.dll

.dll 280KB

e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a.dll

IMPHASH 307361dd86ec27ba4aec118d1cf145c9
SHA256 e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a
MD5 376064351308815baa1cedb83e67b356
SHA1 f0e8d7c1b16adbb734d5254e70b3f6f5f616b09b
SHA512 d2e83c2e97a11f22041a5936259829ba465098f8db501fe980b90829f43132cc31d29a50abbae1d4cce2693eff837b00643489a61afe29592d65b65bf177f8fa
SSDEEP 6144:k+J6EWI9FatwUCLTlNy03xW3kLi7GfQpCsf2UAW:N6PeFatCLTlNy0hji7mZe2rW
TLSH
T1CF548C22E3954470F27B0A315077D1638BBDBA508BB48DD7639A202D3DA37F1A934B5E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3b:fd:71:7f:f0:df:0f:69:64:68:29:75:b4:c0:37:a8:e8:28:a1:2e:c3:f7:09:20:da:8b:42:20:32:d8:74:5e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SPAGETTI LTD,O=SPAGETTI LTD,POSTALCODE=DE73 5AP,STREET=30 AVALON DRIVE CHELLASTON,L=DERBY,ST=Derbyshire,C=GB

Chains

Nov 30, 2020

CN=SPAGETTI LTD,O=SPAGETTI LTD,POSTALCODE=DE73 5AP,STREET=30 AVALON DRIVE CHELLASTON,L=DERBY,ST=Derbyshire,C=GB

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=SPAGETTI LTD,O=SPAGETTI LTD,POSTALCODE=DE73 5AP,STREET=30 AVALON DRIVE CHELLASTON,L=DERBY,ST=Derbyshire,C=GB

Serial Number

79:e1:cc:0f:67:22:e1:a2:c4:64:7c:21:02:3c:a4:ee

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2020 - Nov 28, 2021

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

200066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\HeavyAsk\tableSeveral\HimCome\ballHer\DescribeMay\Mean.pdb

kernel32

VirtualProtectEx OpenProcess Sleep LoadResource CloseHandle GetSystemTime GetModuleHandleW CreateProcessW FindResourceW GetWindowsDirectoryW GetCurrentDirectoryW CreateFileW FindFirstChangeNotificationW QueryPerformanceCounter GetVersionExW GetDateFormatW WriteConsoleW FlushFileBuffers HeapSize GetStringTypeW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetProcAddress IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind GetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException InterlockedFlushSList SetLastError EncodePointer DuplicateHandle GetFileType ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc HeapReAlloc SetStdHandle GetStdHandle WriteFile GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringW SetEndOfFile ReadFile ReadConsoleW DecodePointer

user32

CallNextHookEx EnumWindows GetWindowLongW SetForegroundWindow DrawTextW IsClipboardFormatAvailable SetClipboardData SendDlgItemMessageW CheckRadioButton DestroyWindow GetClassInfoExW DefWindowProcW SendMessageW ReleaseDC

shlwapi

PathUnquoteSpacesW PathStripPathW PathRemoveBlanksW PathRemoveBackslashW PathRemoveArgsW StrStrIW

Name

.text

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

e7f9b5692e7f51ee1711ef2f344f7fdacf4387712c38a82b1361679ab76da12a.dll

PE Signature issue

kernel32

user32

shlwapi

generic