temper.dll
First submission 2023-03-16 10:24:10
File details
File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
File type: | 12691.93 KB (12996536 bytes) |
Compile time: | 2023-02-25 13:07:43 |
MD5: | 3b3d7619eb68e228800d9c3f5ac23ee3 |
SHA1: | 3007b4cd5ab4d940e2cf9e116134f22deda586ea |
SHA256: | ae8bce2c950ea683276425246918a82935cb7214d08190d5996e31876208ab77 |
Import Hash : | 07b23fc5e1b71c8e48ba0022040270f6 |
Sections 9 | VvT"<;zd yr5aGcw\ 9OTQ.L=k 2!C`9z.; [rd,OMMv wu0&fIa< r0?ng8X0 :0Of[v(^ 0CO!k.J> |
Directories 5 | security relocation resource export import |
Virus Total: | 5/59 VT report date: 2023-03-16 08:31:18 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
PE Sections 7 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
VvT"<;zd | 0x1000 | 0x2daa | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
yr5aGcw\ | 0x4000 | 0xa55 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
9OTQ.L=k | 0x5000 | 0x253 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
2!C`9z.; | 0x6000 | 0x1b0 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
[rd,OMMv | 0x7000 | 0x6c88d9 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
wu0&fIa< | 0x6d0000 | 0x880 | 2560 | e0d560947855dccc1d7f8a3a27bb0ac825d7f683 | e624dbe4fd563b482d93264b3f790eb3 | |
r0?ng8X0 | 0x6d1000 | 0xc4c6c8 | 12896256 | 03846fb3689363dad4b6c4548c8542c868122544 | 12fff098f127d2f9aa384cae39d32698 | |
:0Of[v(^ | 0x131e000 | 0xf0 | 512 | d82dc25818b62be4b102d4830f6a48ed0b5d7fc2 | 6130aa529b8da5bddd4b6a278a5c3c93 | |
0CO!k.J> | 0x131f000 | 0x1631a | 91136 | dbda349e7b1e0fd083dc76ab40041b9d28b91ede | c42d7d4673aaabab711e04a53fe9a616 |
PE Resources 4
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1333d18 | 1128 | |
RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1334180 | 188 | |
RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1334730 | 1032 | |
RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1334b38 | 2018 |
Meta infos 9
FileDescription: | BingWallpaper |
LegalCopyright: | \xa9 Microsoft Corporation. All rights reserved. |
Translation: | 0x0409 0x04b0 |
InternalName: | Wextract |
ProductName: | BingWallpaper |
CompanyName: | Microsoft Corporation |
FileVersion: | 2.0.0.0 |
OriginalFilename: | WEXTRACT.EXE .MUI |
ProductVersion: | 2.0.0.0 |
Anti debug functions 5
GetLastError |
IsDebuggerPresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
File signature
MD5 | SHA1 | Block size | Virtual Address |
---|---|---|---|
9c7582100ee096239b213064b18a1b07 | 08426d96c722e46b1d2a418b8ab0adfae22adf68 | 5048 | 12991488 |
Strings analysis - File found
Database |
0\.db |
Library |
KERNEL32.dll |
xPws2_32.dll |
secur32.dll |
8ole32.dll |
pAdvapi32.dll |
~user32.dll |
socks64.dll |
Strings analysis - Possible URLs found 8
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0 |
https://d.symcb.com/rpa0. |
https://d.symcb.com/rpa0@ |
http://ts-ocsp.ws.symantec.com0; |
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0( |
http://s.symcd.com06 |
https://d.symcb.com/cps0% |
http://s.symcb.com/universal-root.crl0 |
Import functions
PE Exports 1 suspicious
Function | Address |
---|---|
rundll | 0x180001020 |