before[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
before.dll
Size 480KB
Sample220407-fxj1wsbhd9
SHA256 3afb4ff25f4f84c8e91f17a9fa6e54985326950adb3a8cb9411f085daecd51b5
MD5 efc5971616dbead4d725fc3750938911
SHA1 75341c88f4ba71d07ab64f2dfcdc692ee95eefef
SHA512 6f075a3a217489539e610dfd083cf684f1ead36b0a41bd9588932e17c7d68909678d6b73977147c3ddeaba3f0dd51e4fa681bcd3e989040d184d1f4ba800a857
SSDEEP 6144:XJDdcNtINDR6/qONZyPf71mOFFxFpkHPJM972QHnJPFVkecjYxZCg1vqe3oz:XJDdWtINDccPf71v7zWwpzkjjib5qN
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

before.dll

.dll 480KB

before.dll

IMPHASH a448374f8b67c586a912b8de4f455476
SHA256 3afb4ff25f4f84c8e91f17a9fa6e54985326950adb3a8cb9411f085daecd51b5
MD5 efc5971616dbead4d725fc3750938911
SHA1 75341c88f4ba71d07ab64f2dfcdc692ee95eefef
SHA512 6f075a3a217489539e610dfd083cf684f1ead36b0a41bd9588932e17c7d68909678d6b73977147c3ddeaba3f0dd51e4fa681bcd3e989040d184d1f4ba800a857
SSDEEP 6144:XJDdcNtINDR6/qONZyPf71mOFFxFpkHPJM972QHnJPFVkecjYxZCg1vqe3oz:XJDdWtINDccPf71v7zWwpzkjjib5qN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Minor OS version

Major OS version

Entry point

59410

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapReAlloc HeapSize GetACP GetTimeZoneInformation LCMapStringA LCMapStringW Sleep HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW RaiseException GetEnvironmentStringsW SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA GetProfileStringA InterlockedExchange TerminateProcess GetCommandLineA HeapAlloc HeapFree RtlUnwind GetTickCount FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetFileSize GetShortPathNameA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindClose DeleteFileA MoveFileA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle GetOEMCP GetCPInfo GetThreadLocale GetProcessVersion GetCurrentDirectoryA TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalAlloc SizeofResource SetLastError GlobalFlags MulDiv FormatMessageA LocalFree WideCharToMultiByte InterlockedDecrement InterlockedIncrement MultiByteToWideChar GetLastError GetDiskFreeSpaceA GetFileTime SetFileTime GetFullPathNameA GetTempFileNameA lstrcpynA GetFileAttributesA LoadLibraryA FreeLibrary GetVersion lstrcatA GlobalGetAtomNameA GlobalFindAtomA lstrcpyA GetModuleHandleA GetProcAddress lstrlenA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GlobalAddAtomA CloseHandle GetModuleFileNameA GlobalAlloc GlobalDeleteAtom lstrcmpA lstrcmpiA GetCurrentThread GetCurrentThreadId GlobalLock GlobalUnlock GlobalFree LockResource FindResourceA LoadResource GetEnvironmentStrings ExitProcess

user32

SetRect GetNextDlgGroupItem MessageBeep CharUpperA SetTimer KillTimer WindowFromPoint InflateRect SetCapture InvertRect FillRect GetDCEx LockWindowUpdate RegisterClipboardFormatA PostThreadMessageA DeferWindowPos GetClientRect BeginDeferWindowPos CopyRect EndDeferWindowPos GetTopWindow IsChild GetCapture WinHelpA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID DefWindowProcA CreateWindowExA GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect MapDialogRect CopyAcceleratorTableA SetWindowContextHelpId GrayStringA SetFocus ShowWindow SetWindowPos MoveWindow SetWindowLongA GetDlgCtrlID GetWindowTextLengthA GetWindowTextA SetWindowTextA IsDialogMessageA SendDlgItemMessageA GetMenuStringA GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetMessageA TranslateMessage DispatchMessageA GetKeyState CallNextHookEx ValidateRect IsWindowVisible PeekMessageA GetCursorPos SetWindowsHookExA GetLastActivePopup MessageBoxA UpdateWindow HideCaret ShowCaret ExcludeUpdateRgn DrawFocusRect DefDlgProcA IsWindowUnicode EnableWindow SetCursor ShowOwnedPopups PostMessageA PostQuitMessage GetNextDlgTabItem EndDialog GetActiveWindow SetActiveWindow IsWindow GetSystemMetrics CreateDialogIndirectParamA DestroyWindow GetParent GetWindowLongA GetDlgItem CharNextA DestroyIcon LoadStringA GetSysColorBrush GetWindow LoadCursorA IsWindowEnabled SendMessageA InvalidateRect DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ClientToScreen GetClassNameA GetSystemMenu DeleteMenu AppendMenuA IsRectEmpty SetParent PtInRect GetDC ReleaseDC IsZoomed BringWindowToTop UnpackDDElParam ReuseDDElParam SetMenu LoadMenuA DestroyMenu GetDesktopWindow ReleaseCapture TranslateAcceleratorA LoadAcceleratorsA SetRectEmpty LoadIconA EqualRect GetSysColor AdjustWindowRectEx InsertMenuA wsprintfA ScreenToClient MapWindowPoints

gdi32

GetDeviceCaps GetStockObject SaveDC RestoreDC SetBkMode SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect SetTextAlign CreateFontIndirectA CreateRectRgn GetViewportExtEx GetWindowExtEx CreateSolidBrush CreatePatternBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextColor GetBkColor DPtoLP LPtoDP BitBlt GetMapMode PatBlt SetRectRgn CombineRgn CreateRectRgnIndirect CreateFontA GetCharWidthA DeleteObject CreateCompatibleBitmap CreateCompatibleDC StretchDIBits DeleteDC GetTextMetricsA SelectObject GetTextExtentPoint32A GetObjectA SetBkColor SetTextColor GetClipBox CreateDIBitmap GetTextExtentPointA CreateBitmap

comdlg32

GetSaveFileNameA GetFileTitleA GetOpenFileNameA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegQueryValueExA RegSetValueA RegCreateKeyA GetFileSecurityA SetFileSecurityA RegDeleteValueA RegSetValueExA RegQueryValueA RegOpenKeyExA RegCreateKeyExA RegDeleteKeyA RegOpenKeyA RegEnumKeyA RegCloseKey

shell32

ExtractIconA DragQueryFileA DragFinish SHGetFileInfoA

comctl32

ord17

oledlg

ord8

ole32

CoFreeUnusedLibraries OleInitialize CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard OleUninitialize

olepro32

ord253

oleaut32

SysAllocStringLen VariantClear VariantTimeToSystemTime VariantCopy VariantChangeType SysAllocString SysAllocStringByteLen SysStringLen SysFreeString