temper.dll

First submission 2023-03-16 10:24:10

File details

File type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
File type: 12691.93 KB (12996536 bytes)
Compile time: 2023-02-25 13:07:43
MD5: 3b3d7619eb68e228800d9c3f5ac23ee3
SHA1: 3007b4cd5ab4d940e2cf9e116134f22deda586ea
SHA256: ae8bce2c950ea683276425246918a82935cb7214d08190d5996e31876208ab77
Import Hash : 07b23fc5e1b71c8e48ba0022040270f6
Sections 9 VvT"<;zd yr5aGcw\ 9OTQ.L=k 2!C`9z.; [rd,OMMv wu0&fIa< r0?ng8X0 :0Of[v(^ 0CO!k.J>
Directories 5 security relocation resource export import
Virus Total: 5/59 VT report date: 2023-03-16 08:31:18

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://45.15.159.199/temper.dll VirusTotal Report 45.15.159.199 VirusTotal Report 2023-03-16 10:24:11

PE Sections 7 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
VvT"<;zd 0x1000 0x2daa 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
yr5aGcw\ 0x4000 0xa55 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
9OTQ.L=k 0x5000 0x253 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
2!C`9z.; 0x6000 0x1b0 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
[rd,OMMv 0x7000 0x6c88d9 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
wu0&fIa< 0x6d0000 0x880 2560 e0d560947855dccc1d7f8a3a27bb0ac825d7f683 e624dbe4fd563b482d93264b3f790eb3
r0?ng8X0 0x6d1000 0xc4c6c8 12896256 03846fb3689363dad4b6c4548c8542c868122544 12fff098f127d2f9aa384cae39d32698
:0Of[v(^ 0x131e000 0xf0 512 d82dc25818b62be4b102d4830f6a48ed0b5d7fc2 6130aa529b8da5bddd4b6a278a5c3c93
0CO!k.J> 0x131f000 0x1631a 91136 dbda349e7b1e0fd083dc76ab40041b9d28b91ede c42d7d4673aaabab711e04a53fe9a616

PE Resources 4

Name Language Sublanguage Offset Size Data
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x1333d18 1128
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x1334180 188
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x1334730 1032
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x1334b38 2018

Meta infos 9

FileDescription: BingWallpaper
LegalCopyright: \xa9 Microsoft Corporation. All rights reserved.
Translation: 0x0409 0x04b0
InternalName: Wextract
ProductName: BingWallpaper
CompanyName: Microsoft Corporation
FileVersion: 2.0.0.0
OriginalFilename: WEXTRACT.EXE .MUI
ProductVersion: 2.0.0.0

Anti debug functions 5

GetLastError
IsDebuggerPresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

File signature

MD5 SHA1 Block size Virtual Address
9c7582100ee096239b213064b18a1b07 08426d96c722e46b1d2a418b8ab0adfae22adf68 5048 12991488

Strings analysis - File found

Database
0\.db
Library
KERNEL32.dll
xPws2_32.dll
secur32.dll
8ole32.dll
pAdvapi32.dll
~user32.dll
socks64.dll

Strings analysis - Possible URLs found 8

http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
https://d.symcb.com/rpa0.
https://d.symcb.com/rpa0@
http://ts-ocsp.ws.symantec.com0;
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
http://s.symcd.com06
https://d.symcb.com/cps0%
http://s.symcb.com/universal-root.crl0

Import functions

PE Exports 1 suspicious

Function Address
rundll 0x180001020