19a[.]dll | Triage™

General

Target
19a.dll
Size 1.1MB
Sample220519-wgaehsacg4
SHA256 5fa56c3c2cc2b06792ce65be87efd3930d66d8d80791ddc76204f841ac261f43
MD5 9eed94695a18301152a1fef1de8c07d1
SHA1 f93a7a8bd08dc1e22179aee66a13ab0606e09e07
SHA512 b51f58874428e5911f2b97977fd334b068117495381045db7f8deb08848fbc40d958a0ea16e99751e32445e67e883c2a3e80628f45e1cf96117a72efa95c9e81
SSDEEP 24576:cQhT0arccNKYXlpQ7yKnDhcGbmwDgVngnXdFZAkr:cQZ0ErNKqPKDlb
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

19a.dll

.dll 1.1MB

19a.dll

IMPHASH ebee800dfb64d0938112223e3352548e
SHA256 5fa56c3c2cc2b06792ce65be87efd3930d66d8d80791ddc76204f841ac261f43
MD5 9eed94695a18301152a1fef1de8c07d1
SHA1 f93a7a8bd08dc1e22179aee66a13ab0606e09e07
SHA512 b51f58874428e5911f2b97977fd334b068117495381045db7f8deb08848fbc40d958a0ea16e99751e32445e67e883c2a3e80628f45e1cf96117a72efa95c9e81
SSDEEP 24576:cQhT0arccNKYXlpQ7yKnDhcGbmwDgVngnXdFZAkr:cQZ0ErNKqPKDlb
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

11692

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA FindFirstFileA FindNextFileA GetFileType ReadFile CloseHandle GetLastError HeapAlloc GetProcessHeap ExitProcess GetCurrentThreadId GetModuleFileNameA SwitchToFiber CreateFiber ConvertThreadToFiber CallNamedPipeA CreateActCtxA ActivateActCtx DeactivateActCtx QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapFree LCMapStringW FindClose FindFirstFileExA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle GetStringTypeW HeapSize HeapReAlloc SetStdHandle WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW RaiseException

Name

.text

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

337KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

726KB

Virtual Size

730KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

19a.dll

kernel32