y31FF[.]tmp[.]dll | Triage™

General

Target
y31FF.tmp.dll
Size 558KB
Sample220607-np1mnsabdk
SHA256 16851d915aaddf29fa2069b79d50fe3a81ecaafd28cde5b77cb531fe5a4e6742
MD5 6cd2a93c20957124f5878204ec3ed726
SHA1 853c8a814279422abd0dded0e001011401b12826
SHA512 28069434730710ef08321e1c934d1da8a0f649ed38b9d53a8c3ecc044a747c7f641d022bed42ccb43d912c4447515d9418340ffa778a2a901778360ecb6ee80f
SSDEEP 12288:m9aW1fWKhkwg14YhUl+6uuKyfX4pdl23OVSRUBZM2bEP:mkW1fOoguBsO3P6G2bE
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

y31FF.tmp.dll

.dll 558KB

y31FF.tmp.dll

IMPHASH dfd8d552723e495f48ae2a7b0a8a637b
SHA256 16851d915aaddf29fa2069b79d50fe3a81ecaafd28cde5b77cb531fe5a4e6742
MD5 6cd2a93c20957124f5878204ec3ed726
SHA1 853c8a814279422abd0dded0e001011401b12826
SHA512 28069434730710ef08321e1c934d1da8a0f649ed38b9d53a8c3ecc044a747c7f641d022bed42ccb43d912c4447515d9418340ffa778a2a901778360ecb6ee80f
SSDEEP 12288:m9aW1fWKhkwg14YhUl+6uuKyfX4pdl23OVSRUBZM2bEP:mkW1fOoguBsO3P6G2bE
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

4560

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime VirtualProtectEx LocalFree GetFileSize WriteFile MultiByteToWideChar GetModuleHandleExA GetModuleHandleW WideCharToMultiByte FormatMessageA UnmapViewOfFile CreateFileMappingA MapViewOfFile VirtualFree VirtualAlloc FreeLibrary GetProcAddress IsBadReadPtr CreateThread HeapSize WriteConsoleW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CloseHandle CreateFileA GetLastError GetCommandLineA GetModuleHandleA LocalAlloc WaitForSingleObject SetFilePointer OutputDebugStringA GetCurrentProcess SetLastError GetFileType GetStdHandle GetACP GetModuleFileNameA GetModuleHandleExW ExitProcess ReadFile CreateFileW LoadLibraryExW RaiseException InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess HeapAlloc HeapReAlloc HeapFree RtlUnwind

user32

GetCursorPos BeginPaint UpdateWindow EndPaint KillTimer GetMessageA DispatchMessageA LoadCursorA FillRect CreateWindowExW RegisterClassExW LoadStringW wsprintfA ShowWindow GetAsyncKeyState TranslateAcceleratorA SetTimer LoadAcceleratorsA DefWindowProcA SetLayeredWindowAttributes TranslateMessage SendMessageA LoadIconA GetClientRect

gdi32

Ellipse GetStockObject SelectObject

Name

.text

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

293KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.upx1

Size

1024B

Virtual Size

609B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

y31FF.tmp.dll

kernel32

user32

gdi32