msvcr170[.]dll | Triage™

Resubmissions

27/10/2022, 16:10

221027-tmrjwacggm10

21/02/2022, 16:53

220221-vecanabffq8

Sharing

Copy URL Twitter E-mail

General

Target
msvcr170.dll
Size 250KB
Sample220221-vecanabffq
SHA256 2f11ca3dcc1d9400e141d8f3ee9a7a0d18e21908e825990f5c22119214fbb2f5
MD5 6ac740ebf98df7217d31cb826a207af6
SHA1 6bf6fc77b10f6700fa0b868f6d3515b495d1e1e0
SHA512 e0d57245047e3689f4804ed75dfcf9b1468473952a5a6bdab5ff164af1b3e5fc220ba0d737a53cb3f8318e10ef42c3ff5a5763487e2b10c785aab14eacbcde5c
SSDEEP 6144:Lo77pPOYfVtaoP/IbI9ezw79SycUB0Xy:LolfHHPQ6Sywi
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

msvcr170.dll

.dll 250KB

msvcr170.dll

IMPHASH 8d9e46cd144e8903cb32b998390c2389
SHA256 2f11ca3dcc1d9400e141d8f3ee9a7a0d18e21908e825990f5c22119214fbb2f5
MD5 6ac740ebf98df7217d31cb826a207af6
SHA1 6bf6fc77b10f6700fa0b868f6d3515b495d1e1e0
SHA512 e0d57245047e3689f4804ed75dfcf9b1468473952a5a6bdab5ff164af1b3e5fc220ba0d737a53cb3f8318e10ef42c3ff5a5763487e2b10c785aab14eacbcde5c
SSDEEP 6144:Lo77pPOYfVtaoP/IbI9ezw79SycUB0Xy:LolfHHPQ6Sywi
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

4944

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateProcessA CreateSemaphoreW DeleteCriticalSection EnterCriticalSection GetComputerNameExA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadContext GetTickCount GetTimeZoneInformation InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MapViewOfFile MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSemaphore ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadContext SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAllocEx VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _assert _ctime64 _errno _initterm _lock _unlock abort calloc fclose fopen fputc fputs free fwrite islower isspace isupper localeconv malloc memchr memcmp memcpy memmove memset realloc signal sprintf strcmp strerror strlen strncmp vfprintf wcslen _write _read _fileno

psapi

GetModuleInformation

shell32

SHGetFolderPathA

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile

ws2_32

WSAStartup gethostbyname gethostname inet_ntoa

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

81B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ