freebl3.dll
First submission 2023-02-06 10:39:01
File details
| File type: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
| File type: | 669.33 KB (685392 bytes) |
| Compile time: | 2022-09-02 18:53:07 |
| MD5: | 550686c0ee48c386dfcb40199bd076ac |
| SHA1: | ee5134da4d3efcb466081fb6197be5e12a5b22ab |
| SHA256: | edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa |
| Import Hash : | f781fa19ee3108d3fcdb3967b70bbdf5 |
| Sections 6 | .text .rdata .data .00cfg .rsrc .reloc |
| Directories 6 | security relocation debug resource export import |
| Virus Total: | 0/68 VT report date: 2023-02-06 01:42:21 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 49
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://65.109.2.12/4b219a338978614c/freebl3.dll  |
65.109.2.12 |
2023-04-04 17:39:06 |
| hXXp://65.109.226.91/d59bbb0059c11725/freebl3.dll |
65.109.226.91 |
2023-04-03 09:09:08 |
| hXXp://94.142.138.240/5bb6c0fcffd2a07e/freebl3.dll |
94.142.138.240 |
2023-04-02 17:26:08 |
| hXXp://5.75.232.223/f7a5529f1c222f09/freebl3.dll |
5.75.232.223 |
2023-04-02 10:02:09 |
| hXXp://79.137.206.15/a472d2f653c1a1f6/freebl3.dll |
79.137.206.15 |
2023-03-30 10:25:12 |
| hXXp://5.75.155.1/708bdf53d26d3adb/freebl3.dll |
5.75.155.1 |
2023-03-29 19:41:09 |
| hXXp://joscramp.top/c043bcd0ba06ae1d/freebl3.dll |
joscramp.top |
2023-03-27 08:33:04 |
| hXXp://ergrtgrtgwrgrgrgrgwregergerg.cloud/57e916a132e21689/freebl3.dll |
ergrtgrtgwrgrgrgrgwregergerg.cloud |
2023-03-26 14:40:03 |
| hXXp://116.203.125.44/55f8f885bc7c41c8/freebl3.dll |
116.203.125.44 |
2023-03-26 13:02:05 |
| hXXp://91.107.196.27/88e91184e089da83/freebl3.dll |
91.107.196.27 |
2023-03-25 15:17:20 |
| hXXp://64.52.80.24/44e581d4d561245d/freebl3.dll |
64.52.80.24 |
2023-03-24 20:18:22 |
| hXXp://179.43.155.203/d5db58de6330d74d/freebl3.dll |
179.43.155.203 |
2023-03-21 10:00:09 |
| hXXp://193.42.32.154/d290314faa8c02a0/freebl3.dll |
193.42.32.154 |
2023-03-21 09:20:16 |
| hXXp://162.55.215.42/00ed239db35c969b/freebl3.dll |
162.55.215.42 |
2023-03-19 21:01:12 |
| hXXp://193.233.20.145/5710029e9331c3e2/freebl3.dll |
193.233.20.145 |
2023-03-17 18:18:07 |
| hXXp://gouged-out.com/db2f03e4b3a9a447/freebl3.dll |
gouged-out.com |
2023-03-17 18:13:08 |
| hXXp://azqewrtynuytcdrxrszaesxcdtfvbgu.shop/57e916a132e21689/freebl3.dll |
azqewrtynuytcdrxrszaesxcdtfvbgu.shop |
2023-03-17 09:56:08 |
| hXXp://91.215.85.213/4a4993f1399adf8e/freebl3.dll |
91.215.85.213 |
2023-03-16 07:35:44 |
| hXXp://179.43.175.10/0feffcf7a685a01f/freebl3.dll |
179.43.175.10 |
2023-03-15 15:40:22 |
| hXXp://givesc.link/c043bcd0ba06ae1d/freebl3.dll |
givesc.link |
2023-03-14 20:44:13 |
| hXXp://5.42.199.9/25f588723ad06749/freebl3.dll |
5.42.199.9 |
2023-03-13 08:20:08 |
| hXXp://85.31.45.100/ab1186283f0a6f80/freebl3.dll |
85.31.45.100 |
2023-03-06 11:15:34 |
| hXXp://23.88.122.134/579d5c7e95a610c1/freebl3.dll |
23.88.122.134 |
2023-02-26 07:37:07 |
| hXXp://systemupdate-microsoft.top/852ee5ffe0de00c3/freebl3.dll |
systemupdate-microsoft.top |
2023-02-25 14:38:12 |
| hXXp://91.215.85.213/d1c0c3851212ede5/freebl3.dll |
91.215.85.213 |
2023-02-24 01:05:04 |
| hXXp://moneylandry.com/2ccaf544c0cf7de7/freebl3.dll |
moneylandry.com |
2023-02-06 10:39:02 |
| hXXp://23.227.202.68/dcd28e4a9f9aaae4/freebl3.dll |
23.227.202.68 |
2023-04-07 08:40:05 |
| hXXp://45.61.137.151/1a90bc2aa73eeb41/freebl3.dll |
45.61.137.151 |
2023-04-09 09:25:05 |
| hXXp://31.41.244.251/7d4d1cce701c8617/freebl3.dll |
31.41.244.251 |
2023-04-15 12:39:08 |
| hXXp://45.159.248.242/ffa2f6cf414d2e27/freebl3.dll |
45.159.248.242 |
2023-04-16 09:28:05 |
| hXXp://193.109.85.62/3fe731d12392c2d1/freebl3.dll |
193.109.85.62 |
2023-04-17 07:42:04 |
| hXXp://jeffmorales.top/c043bcd0ba06ae1d/freebl3.dll |
jeffmorales.top |
2023-04-17 10:13:06 |
| hXXp://metacarpusget.top/c043bcd0ba06ae1d/freebl3.dll |
metacarpusget.top |
2023-04-20 09:55:04 |
| hXXp://212.86.109.106/df6db770d6188cea/freebl3.dll |
212.86.109.106 |
2023-04-30 18:58:04 |
| hXXp://128.140.91.217/16c60772756db6d6/freebl3.dll |
128.140.91.217 |
2023-05-05 11:28:05 |
| hXXp://82.117.255.211/91c24011244729db/freebl3.dll |
82.117.255.211 |
2023-05-14 10:19:04 |
| hXXp://193.233.134.93/2bbda8fbc3a204ca/freebl3.dll |
193.233.134.93 |
2023-05-16 08:40:05 |
| hXXp://141.98.6.54/4359869ad40fabf5/freebl3.dll |
141.98.6.54 |
2023-05-17 14:39:05 |
| hXXp://179.43.142.99/6bad8dda11fd59df/freebl3.dll |
179.43.142.99 |
2023-05-19 08:33:05 |
| hXXp://193.42.32.206/f1e54b61d5902e6f/freebl3.dll |
193.42.32.206 |
2023-05-21 16:20:04 |
| hXXp://91.107.224.54/4184da83d7329318/freebl3.dll |
91.107.224.54 |
2023-05-22 15:32:04 |
| hXXp://194.180.48.244/f39178c3b20212bf/freebl3.dll |
194.180.48.244 |
2023-05-23 08:21:03 |
| hXXp://77.91.123.112/b88e8da02b778847/freebl3.dll |
77.91.123.112 |
2023-05-23 08:27:03 |
| hXXp://ronaldlitt.top/3abdf8b5527012d0/freebl3.dll |
ronaldlitt.top |
2023-05-26 07:58:04 |
| hXXp://5.78.104.48/9b1f6ccc381135e1/freebl3.dll |
5.78.104.48 |
2023-05-26 20:53:04 |
| hXXp://5.78.100.243/86e22536ab555259/freebl3.dll |
5.78.100.243 |
2023-05-28 08:40:04 |
| hXXp://77.105.146.130/791db24d796b6003/freebl3.dll |
77.105.146.130 |
2023-05-28 09:39:04 |
| hXXp://5.42.66.25/287dbd4538093b9e/freebl3.dll |
5.42.66.25 |
2023-05-28 09:45:04 |
| hXXp://179.43.162.125/ac1767bd0d56c4c8/freebl3.dll |
179.43.162.125 |
2023-05-30 09:17:03 |
PE Sections 2 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x80c95 | 527872 | 8436ccc2a34632f47c9e1adcef2f1a1b5f14efde | 6e3626d2271b78d42d646159d0b9c9a2 | |
| .rdata | 0x82000 | 0x206c4 | 133120 | 18215be397cc191726d33368ecc83e04eaa70032 | 1f2db9bf557bbf2fbc56e1821605126d | |
| .data | 0xa3000 | 0x463c | 512 | ed675095bb52a589bffc1c259bb4ad128e3c6229 | 9332b6379db7791ae2cd552085c6ffa6 | |
| .00cfg | 0xa8000 | 0x4 | 512 | 26ea52ea5f1edc106377e79520659fda08d061af | 3e88e89b3dcafaf3699d2c8c2c3c897e | |
| .rsrc | 0xa9000 | 0x378 | 1024 | 3076071c06ec24e1982887f5ce55b004984f15c7 | d5f4c3c911ff336192b64ebaa9fab7a6 | |
| .reloc | 0xaa000 | 0x23f0 | 9216 | e8a592a1c3b9c7b7c578631f20eaad1a293332f9 | a93e29d0b0b0b39e1da4084a41dcb105 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xa9060 | 792 |
Meta infos 12
| BuildID: | 20220902153754 |
| OriginalFilename: | freebl3.dll |
| Translation: | 0x0000 0x04b0 |
| InternalName: | |
| FileVersion: | 104.0.2 |
| LegalTrademarks: | Mozilla |
| ProductVersion: | 104.0.2 |
| FileDescription: | |
| LegalCopyright: | License: MPL 2 |
| Comments: | |
| ProductName: | Firefox |
| CompanyName: | Mozilla Foundation |
Packers detected 1
| Borland Delphi 3.0 (???) |
Anti debug functions 4
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| 952a7d7423c8a2b375edb162e36f4e27 | aa3c0324db5f08bf932b4c064105a532ca3591d0 | 12112 | 673280 |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| nss3.dll |
| vcruntime140.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| api-ms-win-crt-time-l1-1-0.dll |
| ADVAPI32.dll |
| api-ms-win-crt-utility-l1-1-0.dll |
| freebl3.dll |
Strings analysis - Possible URLs found 22
| https://www.digicert.com/CPS0 |
| http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0 |
| http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E |
| http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: |
| http://crl4.digicert.com/DigiCertGlobalRootCA.crl07 |
| http://ocsp.digicert.com0X |
| http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0 |
| http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O |
| https://mozilla.org0/ |
| http://ocsp.digicert.com0N |
| http://crl3.digicert.com/DigiCertGlobalRootCA.crl0= |
| http://ocsp.digicert.com0A |
| http://ocsp.digicert.com0C |
| http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0 |
| http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 |
| http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 |
| http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C |
| http://crl3.digicert.com/sha2-assured-cs-g1.crl05 |
| http://www.digicert.com/CPS0 |
| http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0 |
| http://ocsp.digicert.com0 |
| http://crl4.digicert.com/sha2-assured-cs-g1.crl0K |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| FREEBL_GetVector | 0x10058980 |