ESYAIHPB[.]DLL | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ESYAIHPB.DLL
Size 84KB
Sample261022-272vcaax2p
SHA256 0c15d7cf03026624a6ed3073864680605f664eef96629bbb4189de02ab9a35d5
MD5 6f59deb85e6cae0ce3e594f3f423a258
SHA1 d0ccd75094908b31f05383f9ece0569c0278d273
SHA512 af568ecdc90dff4565551655be8aef73532a0247b364b380f6ea38edf3150c361c1b7de848f0cf8fa3ff6ccbd4a5c359a7c0dcfff3d5a6e258ff3221e9024773
SSDEEP 1536:mD0xWNWkDg2un3D8QCmCaE40TZtlwu8FfVXHQ:JF4ua40THlwu8XXHQ
TLSH
T11F833A1667FC832BF6FF0F74E9F680861D36FE5A2912C59C588A649D1873B809612337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

ESYAIHPB.DLL

.dll 84KB

ESYAIHPB.DLL

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c15d7cf03026624a6ed3073864680605f664eef96629bbb4189de02ab9a35d5
MD5 6f59deb85e6cae0ce3e594f3f423a258
SHA1 d0ccd75094908b31f05383f9ece0569c0278d273
SHA512 af568ecdc90dff4565551655be8aef73532a0247b364b380f6ea38edf3150c361c1b7de848f0cf8fa3ff6ccbd4a5c359a7c0dcfff3d5a6e258ff3221e9024773
SSDEEP 1536:mD0xWNWkDg2un3D8QCmCaE40TZtlwu8FfVXHQ:JF4ua40THlwu8XXHQ
TLSH
T11F833A1667FC832BF6FF0F74E9F680861D36FE5A2912C59C588A649D1873B809612337
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

e0:cb:4c:4c:e9:d2:fe:f7:6b:a4:a5:3e:7e:5f:b0:d3:b4:38:41:07:eb:b9:bb:c5:dc:f9:69:4d:10:78:0c:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

6f:37:b6:0a:f2:68:31:d6:e8:a3:9b:0c:8f:a1:4a:fb:62:aa:e1:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 11, 2013 - Feb 11, 2015

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2c:d7:29:77:3b:67:cc:1b:c6:00:00:00:00:00:2c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

Major OS version

Entry point

76254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.SqlServer.Configuration.ConfigExtension.pdb

ESYAIHPB.DLL

PE Signature issue

mscoree

dotnet