xcah[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xcah.dll
Size 432KB
Sample220401-xnl8bsbhdm
SHA256 ff8ee64cd72860c39b65e20dcaf8c20bdc76d1fc655ae7639c19b353a853b991
MD5 46640a5981b1a62ec19841bb6ef57e41
SHA1 887517211d31c1c7fe1142b3cdccff7f5d3e28e1
SHA512 8c657aafc4153597f579349de953ca115ad560e25e27288d41bb8d1f14a15d24ad62fbcfac7f1c0b5165d18cd545b0ce7a47cceb7da04a97d025ececd685116c
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDLS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKTrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

xcah.dll

.dll 432KB

xcah.dll

IMPHASH a1307a412c459cd4896a70dba2051692
SHA256 ff8ee64cd72860c39b65e20dcaf8c20bdc76d1fc655ae7639c19b353a853b991
MD5 46640a5981b1a62ec19841bb6ef57e41
SHA1 887517211d31c1c7fe1142b3cdccff7f5d3e28e1
SHA512 8c657aafc4153597f579349de953ca115ad560e25e27288d41bb8d1f14a15d24ad62fbcfac7f1c0b5165d18cd545b0ce7a47cceb7da04a97d025ececd685116c
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDLS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKTrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Minor OS version

Major OS version

Entry point

56258

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess RaiseException HeapReAlloc HeapSize GetACP GetTimeZoneInformation LCMapStringA LCMapStringW Sleep HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA HeapAlloc GetProfileStringA InterlockedExchange HeapFree RtlUnwind FormatMessageA GetFileTime GetFileSize GetFileAttributesA GetTickCount FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle GetOEMCP GetCPInfo GetThreadLocale SizeofResource GetProcessVersion GetLastError WritePrivateProfileStringA GlobalFlags lstrcpynA TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc MultiByteToWideChar WideCharToMultiByte lstrlenA InterlockedIncrement InterlockedDecrement LoadLibraryA FreeLibrary GetVersion lstrcatA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA lstrcpyA MulDiv GetModuleHandleA GetProcAddress SetLastError GlobalUnlock GlobalFree LockResource FindResourceA LoadResource CloseHandle GetModuleFileNameA GlobalLock GlobalAlloc GlobalDeleteAtom lstrcmpA lstrcmpiA GetCurrentThread GetCurrentThreadId FreeEnvironmentStringsA ExitProcess

user32

MessageBeep InvalidateRect CharUpperA InflateRect RegisterClipboardFormatA PostThreadMessageA GetTopWindow IsChild GetCapture WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetWindowTextLengthA GetWindowTextA GetDlgCtrlID DefWindowProcA CreateWindowExA GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow SetWindowLongA RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetNextDlgGroupItem GrayStringA TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen ScreenToClient MapDialogRect SetWindowPos GetWindow SetWindowContextHelpId EndDialog SetActiveWindow IsWindow CreateDialogIndirectParamA GetDlgItem GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageA TranslateMessage DispatchMessageA GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible PeekMessageA GetCursorPos SetWindowsHookExA EnableWindow HideCaret ShowCaret ExcludeUpdateRgn DrawFocusRect DefDlgProcA IsWindowUnicode LoadIconA GetParent GetLastActivePopup IsWindowEnabled GetWindowLongA MessageBoxA SetCursor PostQuitMessage PostMessageA IsIconic GetSystemMetrics GetClientRect DrawIcon SetRect CopyAcceleratorTableA CharNextA GetWindowRect GetSysColorBrush GetSystemMenu AppendMenuA SendMessageA PtInRect GetClassNameA GetDesktopWindow LoadCursorA DestroyMenu LoadStringA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor SetFocus DestroyWindow DrawTextA CopyRect AdjustWindowRectEx

gdi32

SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox IntersectClipRect DeleteObject SetMapMode GetDeviceCaps GetViewportExtEx GetWindowExtEx CreateSolidBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetObjectA BitBlt CreateCompatibleDC GetTextColor GetBkColor DPtoLP LPtoDP GetMapMode PatBlt SetTextColor SetBkMode SetBkColor GetStockObject SelectObject RestoreDC SaveDC DeleteDC CreateDIBitmap GetTextExtentPointA CreateBitmap

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegSetValueExA RegOpenKeyExA RegCreateKeyExA

comctl32

ord17

oledlg

ord8

ole32

CoFreeUnusedLibraries OleInitialize CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard OleUninitialize

olepro32

ord253

oleaut32

SysAllocStringLen VariantClear VariantTimeToSystemTime VariantCopy VariantChangeType SysAllocString SysAllocStringByteLen SysStringLen SysFreeString