dbghelp[.]7z | Triage™

General

Target
dbghelp.7z
Size 2.7MB
Sample220413-ddal1adhf9
SHA256 d09a9e5ccce56752e0576e3f43b7fe4d401c577399853ffa34b4cf765b10f15e
MD5 5b0ce27d91149caf62fa9f6541f7cece
SHA1 d2066f88adc065d67b74337f5464d29eed61fc96
SHA512 28faf027e36fc060a347de40131b1091ab3fa14244b5581553d0b787b562dcbff119368354092f0292c70c1472a2c6a71bfa38e418cc1fdcca31b61ca997d214
SSDEEP 49152:BomyQxczjDgC2Ht2HIHFkitaxWiXV+0/TiLOabNN4mCI+SyEEJq8jbrN:GmyrjcJt2HditaxWSVxTiLOa0mCRS/rc
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

dbghelp.7z

.7z 2.7MB
dbghelp.dll

.dll 242.9MB

dbghelp.7z

SHA256 d09a9e5ccce56752e0576e3f43b7fe4d401c577399853ffa34b4cf765b10f15e
MD5 5b0ce27d91149caf62fa9f6541f7cece
SHA1 d2066f88adc065d67b74337f5464d29eed61fc96
SHA512 28faf027e36fc060a347de40131b1091ab3fa14244b5581553d0b787b562dcbff119368354092f0292c70c1472a2c6a71bfa38e418cc1fdcca31b61ca997d214
SSDEEP 49152:BomyQxczjDgC2Ht2HIHFkitaxWiXV+0/TiLOabNN4mCI+SyEEJq8jbrN:GmyrjcJt2HditaxWSVxTiLOa0mCRS/rc
MD5 SHA1 SHA512 SSDEEP

dbghelp.dll

SHA256 b253368444aba74db84589b6af2a5a0971a11c4129b220203870a4f5a82cd6fd
MD5 31b00fe35cd795058e11e1bc2d8de272
SHA1 e25ebd7ea19dfc1948ac5e50e6166aa73bda5dca
SHA512 ed213e2f0e8e40f2d828c9458fe6b50b4c44ecc0487bc924244b6957115e83737286ff7d082ab89ac11279f4075076b9f65d5d1841a07c0bcae337dd6310f443
SSDEEP 49152:BSjIuHVecUiBfG/aQimk8eGtsLwBnaUSLjV+Xa1TkT:B8HVecUitCk8ZtFqLjx
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

9660944

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

A0DB34FC6FE35D429A28ADDE5467D4D7 DbgHelpCreateUserDump DbgHelpCreateUserDumpW DeinitLightshot DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllUnregisterServer EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExportList ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath Function00001 Function00010 Function00012 Function00025 Function00033 Function00035 Function00036 Function00037 Function00039 Function00043 Function00056 Function00057 Function00058 Function00061 Function00062 Function00063 Function00064 Function00065 Function00066 Function00067 Function00068 Function00073 Function00082 Function00083 GetLoaderInterface GetRegisteredUserName GetTeamViewerInterface GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx InitLightshot IsInternetConnected JAVALI2021 MVDefragStart MVDefragStop MakeScreenshot MakeScreenshotByCommand MakeSureDirectoryPathExists MapDebugInformation MiniDumpReadDumpStream MiniDumpWriteDump OpenPages RegistryCheck RegistryCheckItems RegistryImportFile RunMVDefrag Scintilla_DirectFunction SearchTreeForFile SearchTreeForFileW SetRegistryItem SetTranslations StackWalk StackWalk64 StopMVDefrag SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymCleanup SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrW64 SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW UnmapDebugInformation WinDbgExtensionDllInit __CxxFrameHandler4 __NLG_Dispatch2 __NLG_Return2 __mingwthr_key_dtor __mingwthr_remove_key_dtor _libiconv_version block chksym dbghelp dh fptr homedir itoldyouso libiconv libiconv_close libiconv_open libiconvctl libiconvlist lmi lminfo locale_charset omap png_access_version_number png_build_grayscale_palette png_calloc png_chunk_error png_chunk_warning png_convert_from_struct_tm png_convert_from_time_t png_convert_to_rfc1123 png_create_info_struct png_create_read_struct png_create_read_struct_2 png_create_write_struct png_create_write_struct_2 png_data_freer png_destroy_info_struct png_destroy_read_struct png_destroy_write_struct png_error png_free png_free_data png_free_default png_get_IHDR png_get_PLTE png_get_bKGD png_get_bit_depth png_get_cHRM png_get_cHRM_fixed png_get_channels png_get_chunk_cache_max png_get_chunk_malloc_max png_get_color_type png_get_compression_buffer_size png_get_compression_type png_get_copyright png_get_error_ptr png_get_filter_type png_get_gAMA png_get_gAMA_fixed png_get_hIST png_get_header_ver png_get_header_version png_get_iCCP png_get_image_height png_get_image_width png_get_interlace_type png_get_io_chunk_name png_get_io_ptr png_get_io_state png_get_libpng_ver png_get_mem_ptr png_get_oFFs png_get_pCAL png_get_pHYs png_get_pixel_aspect_ratio png_get_pixels_per_meter png_get_progressive_ptr png_get_rgb_to_gray_status png_get_rowbytes png_get_rows png_get_sBIT png_get_sCAL png_get_sPLT png_get_sRGB png_get_signature png_get_tIME png_get_tRNS png_get_text png_get_uint_31 png_get_unknown_chunks png_get_user_chunk_ptr png_get_user_height_max png_get_user_transform_ptr png_get_user_width_max png_get_valid png_get_x_offset_microns png_get_x_offset_pixels png_get_x_pixels_per_meter png_get_y_offset_microns png_get_y_offset_pixels png_get_y_pixels_per_meter png_handle_as_unknown png_info_init_3 png_init_io png_malloc png_malloc_default png_malloc_warn png_permit_mng_features png_process_data png_progressive_combine_row png_read_end png_read_image png_read_info png_read_png png_read_row png_read_rows png_read_update_info png_reset_zstream png_save_int_32 png_save_uint_16 png_save_uint_32 png_set_IHDR png_set_PLTE png_set_add_alpha png_set_bKGD png_set_background png_set_bgr png_set_cHRM png_set_cHRM_fixed png_set_chunk_cache_max png_set_chunk_malloc_max png_set_compression_buffer_size png_set_compression_level png_set_compression_mem_level png_set_compression_method png_set_compression_strategy png_set_compression_window_bits png_set_crc_action png_set_error_fn png_set_expand png_set_expand_gray_1_2_4_to_8 png_set_filler png_set_filter png_set_filter_heuristics png_set_flush png_set_gAMA png_set_gAMA_fixed png_set_gamma png_set_gray_to_rgb png_set_hIST png_set_iCCP png_set_interlace_handling png_set_invalid png_set_invert_alpha png_set_invert_mono png_set_keep_unknown_chunks png_set_longjmp_fn png_set_mem_fn png_set_oFFs png_set_pCAL png_set_pHYs png_set_packing png_set_packswap png_set_palette_to_rgb png_set_progressive_read_fn png_set_quantize png_set_read_fn png_set_read_status_fn png_set_read_user_chunk_fn png_set_read_user_transform_fn png_set_rgb_to_gray png_set_rgb_to_gray_fixed png_set_rows png_set_sBIT png_set_sCAL png_set_sPLT png_set_sRGB png_set_sRGB_gAMA_and_cHRM png_set_shift png_set_sig_bytes png_set_strip_16 png_set_strip_alpha png_set_swap png_set_swap_alpha png_set_tIME png_set_tRNS png_set_tRNS_to_alpha png_set_text png_set_unknown_chunk_location png_set_unknown_chunks png_set_user_limits png_set_user_transform_info png_set_write_fn png_set_write_status_fn png_set_write_user_transform_fn png_sig_cmp png_start_read_image png_warning png_write_chunk png_write_chunk_data png_write_chunk_end png_write_chunk_start png_write_end png_write_flush png_write_image png_write_info png_write_info_before_PLTE png_write_png png_write_row png_write_rows png_write_sig srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

Name

CODE

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

233.5MB

Virtual Size

233.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

dbghelp.7z

dbghelp.dll