The saas0.dll (Saas Login Service) File Analysis

Updated 2 days ago

Checked by Malaware Check

saas0.dll

Technical Analysis

File Name	saas0.dll
File Type	Win32 DLL
Magic Bytes	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
SSDEEP Hash	98304:N/mZ55HaAJyis0WHmp4JIQ1jkfvs0d7oRh8NBxRS7xC:NE55Hby70ImPQ1jYcRy/rIC
Scanner Version	1.0.218.174
Database Version	2025-06-11 08:00:13 UTC

⚠

Suspicious File Detected

Detected by 9 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

13%

Detection Rate

4,337,528

File Size (bytes)

9/72

Engines Detected

2025-06-11

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	d8b99384c4b5a65003dde2421c87d8de
SHA1	aef175a41d6482d7a9b32b0e0635365f2307b0c5
SHA256	090bb081fddfc9cbbd8c969cd1b986437ec32a75995902fe0cba54ca5a2eef66
SHA512	7220f65de9d9a6184e008ba9d13ec8f34a6e3392751bb57e6263afdbb1a761e62202f66884fa4a4b043993e369ed515ac02f1431f187ca6b13bad07a2ea15cc4
ImpHash	9d9c5a1294cea590fcf37f7f0bd532e4

Security Engines with Detections (9 of 72)

Cylance

Unsafe Malicious

TrendMicro-HouseCall

TROJ_GEN.R002H01F625 Malicious

Google

Detected Malicious

Trapmine

malicious.moderate.ml.score Malicious

Sophos

Mal/VMProtBad-A Malicious

Antiy-AVL

RiskWare[Packed]/Win32.VMProtect.a Malicious

ZoneAlarm

Mal/VMProtBad-A Malicious

Microsoft

Trojan:Win32/Kepavll!rfn Malicious

DeepInstinct

MALICIOUS Malicious

63 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Image Base	`0x00400000`
Entry Point	`0x0089c2e5`
Compilation Time	2025-04-23 09:48:05
Checksum	0x004239ae (Actual: 0x004239ae)
OS Version	6.0
PEiD Signatures	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
Digital Signature	Chain verification from CN=上海柏楚电子科技股份有限公司, O=上海柏楚电子科技股份有限公司, ST=上海市, C=CN (serial:4751702742473103527968974730368020596, sha1:615673d22c57ba1bad2803c5b45a141f8a472c25) failed: The path could not be validated because the end-entity certificate expired 2024-05-28 23:59:59Z
Imports	16 libraries
Exports	2 functions
Resources	49 Resources
Sections	13 Sections

Version Information

▼

CompanyName	Friendess, Inc.
FileDescription	Saas Login Service
FileVersion	2.0.0.0
InternalName	saas
LegalCopyright	All rights reserved (C) 2020 Friendess, Inc.
LegalTrademarks	FSCUT(TM)
OriginalFilename	saas0.dll
ProductName	CypNest
ProductVersion	6.3.0.0
Comments	http://www.fscut.com
Translation	0x0804 0x03a8

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	2,077,144 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x001fd000`	832,808 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.bss`	`0x002c9000`	4,132 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x002cb000`	123,656 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.didata`	`0x002ea000`	372 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x002eb000`	110 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x002ec000`	69 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp0`	`0x002ed000`	94,556 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.pdata`	`0x00305000`	107,772 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp1`	`0x00320000`	1,323,543 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp2`	`0x00464000`	4,287,796 bytes	4,288,000 bytes	7.81 (Packed/Encrypted)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`769FA36E671E8297D890524F8B8C4A28`
`.reloc`	`0x0087b000`	156 bytes	512 bytes	1.49 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CD0DE3547EB9255A52DA50981749CF8F`
`.rsrc`	`0x0087c000`	70,293 bytes	44,544 bytes	5.29 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`0B877B277DCBE74141EC9E6A74E19906`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 49 (66,880 bytes)

Resource Type	Count	Total Size	Percentage
RSA	3	780 bytes	1.2%
RT_CURSOR	1	308 bytes	0.5%
RT_BITMAP	15	21,800 bytes	32.6%
RT_STRING	21	18,420 bytes	27.5%
RT_RCDATA	7	24,680 bytes	36.9%
RT_GROUP_CURSOR	1	20 bytes	0%
RT_VERSION	1	872 bytes	1.3%

Certificate Chain Analysis

▼

Certificate Information

Product	CypNest
Description	Saas Login Service
File Version	2.0.0.0
Original Name	saas0.dll
Verification Status	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Signers	上海柏楚电子科技股份有限公司; DigiCert SHA2 Assured ID Code Signing CA; DigiCert
Internal Name	saas
Copyright	All rights reserved (C) 2020 Friendess, Inc.

Certificate Chain Summary

DigiCert SHA2 Assured ID Code Signing CA #1 Primary

Validity Period: 2013-10-22 12:00:00 → 2028-10-22 12:00:00

Signature Algorithm: sha256RSA

Serial Number: 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08

上海柏楚电子科技股份有限公司 #2 Chain

Validity Period: 2021-05-24 00:00:00 → 2024-05-28 23:59:59

Signature Algorithm: sha256RSA

Serial Number: 03 93 25 08 6D A4 CD A4 5B A8 CE 5C BA 26 70 74

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Chain verification from CN=上海柏楚电子科技股份有限公司, O=上海柏楚电子科技股份有限公司, ST=上海市, C=CN (serial:4751702742473103527968974730368020596, sha1:615673d22c57ba1bad2803c5b45a141f8a472c25) failed: The path could not be validated because the end-entity certificate expired 2024-05-28 23:59:59Z

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

9 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1