R1du[.]dll[.]vir | Triage™

General

Target
R1du.dll.vir
Size 307KB
Sample220621-v9flkaggam
SHA256 bc6d7b7c88d46a22fa0ce4cb21adfd4237fd4318983e4e271c3650cedfd92e7c
MD5 81df6885ea1237a019624a2f047f33e9
SHA1 3f32e185178e882d76d69f694a8fbda22c79263b
SHA512 b82a6357013498033cfcd8244eabce8571cd053a9928dbdc2c5d0e3a5f04ab7c53fb8871864b5a5f99c0bd2251004e1d0fb76a248cff2d92fd1023b8d16d4c41
SSDEEP 6144:3MiSTD2He3kjHfNsQnAzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3XNmCWF1bTSLz
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

R1du.dll.vir

.dll 307KB

R1du.dll.vir

IMPHASH fbb4d9f7f00c9636121e47653fd6dd01
SHA256 bc6d7b7c88d46a22fa0ce4cb21adfd4237fd4318983e4e271c3650cedfd92e7c
MD5 81df6885ea1237a019624a2f047f33e9
SHA1 3f32e185178e882d76d69f694a8fbda22c79263b
SHA512 b82a6357013498033cfcd8244eabce8571cd053a9928dbdc2c5d0e3a5f04ab7c53fb8871864b5a5f99c0bd2251004e1d0fb76a248cff2d92fd1023b8d16d4c41
SSDEEP 6144:3MiSTD2He3kjHfNsQnAzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3XNmCWF1bTSLz
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

14232

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryExW VirtualAlloc WriteConsoleW SetStdHandle CloseHandle HeapSize OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapReAlloc HeapAlloc GetModuleFileNameW WriteFile GetCPInfo GetOEMCP GetCommandLineA GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent GetLastError WideCharToMultiByte EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwindEx SetLastError ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetStringTypeW IsValidCodePage GetACP CreateFileW

user32

EndPaint DestroyWindow TranslateAcceleratorW GetWindowRect GetMessageW PostQuitMessage GetSubMenu DialogBoxParamW LoadCursorW BeginPaint TranslateMessage LoadAcceleratorsW RegisterClassExW LoadIconW TrackPopupMenuEx LoadMenuW EndDialog LoadStringW ShowWindow CreateWindowExW MessageBoxW UpdateWindow DestroyMenu DefWindowProcW DispatchMessageW

AWxCWlhOnLMubKhSFoYdJdGxWq AXjoeuGJnzH AXmxXUOLyQOfTByKBQTzdF AtZWbRddBOb BHxliMBDArDeVZLmPP CQqHoyVpCHpjbZSPOYMlW CTPixtriRQDFkifypRqRsuc CVeMHfUach CoJhoUzNAC DVeHrbblBKBTZylsQnIWrAMjTq DcjBremKPJceMKuYyXVjA DllRegisterServer DnzRZFZAvOgAyCABT EiehIjwIemwbspFiZqTfYdKLa FFNxZnXWjLZDLyhbeenDnzu FVnVixPhvOARYGV GYJgmEWAOgeveZnvB GatDfCXsvqaSyBRrOPl GgdDFFAsPbHKmvllNFj HAKyQCtggmJlsjWcdmF HEJRqEExeb HTRSRFSMlqnEyJAEXHkYjGLe HUxXiShFMQxokjE HbSxzPoiEkYoxPxVFH HfwybIevwJpfIKqEZkel IEYaCRb ISsykaWLZO IXiabpknMqoSiRIAQtzk InOZukRCWlVRV IvEDeGvvYoBzagOYSjILZrq JIHXWSxOJ JPOhOhctEljpUmybGWzTttef JxWYFu KVnUtNoobtsAPB KeXfYWmVosDeakKWQu KnQpnAjYhZ KqFSvz LHFGvnokbdGiOvJeZ LYDSMTJJmqDeskADUyFJe LmxxOwQbNipdXy MFpvyYrdhEGyYDMGkKaffTOv MGJLcPuWWOVxOvabvivRzmEKT MHvbExamLAyIdjZq MqYMsgnEU NIkvlEpbPZJo NNIGQTT NUglEhOEQFBlBVXoZpNWpQr NUhBAQOUgCVvPtjxXivZYhxxu NXjpRxxeAcjTFEvq OOPdcKOF OPrcaOxCFyfYrtUKEHANNNhm OduJhGQ PCLOryMyDJoaNyDja PFofQm POjrQjAFeEOzfyxDQGCoYKlSq PStmUoz PWNiffLlVcAHjzbpaELYvARc PdEmTRNAViMC PfUloVTqrHlCxWPJvabdrMYip QNLKRUZXJwswIXcAJGQ QXNPoIuI QYEFpLBavKhpMSeQrwLyBs RcctwhczAMXYTW SPaxHVYd SXiKEzLfrnr SeFeLycBmGQKg SkBIUfxDTMMifBiRxnoAmftUWG SlLEfDG SqsiwWtpWZHw SsuxhIVnNqKcXhrtUA TCtFrj UEHkbjaXvlAzkkENRWZLRG UaLxelaVreHrOFI UbCDveB UkONVK VAFMqMQIjpgSq VJsbCrXKiohoOtwKpLKgsy VLdrELrDqHIaTFyL VPTVsjVMlEzuWIkSUQ VartPyxSWcn VasbQQePaQH VfvtItlRATfRRfKphvwTAv VrXIVHDYUwXitIXBnXrzxe VwhpKCECwWTyKFBeQwPfaIK WMZbJiBWmkkeDKTcPPYLS WwTJlfKGEFViJ WwTuZy XcaISxWOJfVaZzfjwbPdtcwz XtcpvxeDLrQKGu XzQjPuuVsbXAXxRLdNZRPdEdFS YhnJKcoCFiagYN YhxxmoKjDobEPVxZOYqcfZv YoMlCpCeZUpYCeXT ZJyeJN brauLyfzMO cMZykOUKFcjAFnrnUveUPPOTOo ccBoDZo ckSgBmWcBLAzdfb cviUDOfuCPrAoPJXnonInfds cwrOyYjAzqNgiPqRwFAB czdALDgGT dLffCtTIRjvBncQf ewhJkgCTtJvBkBWwAwtIurmWS fFSFiTKQzluUza fOtuVkmUtndurETlZuIGAvb fkCqlLCMaCXS geTzrCHcvNHNLbGAC gqFtlPffNcrbXk gwwkOioE hIRSsnxxodb hPfrAMBR haedgUYsVasRfqAuPSsTaLMnn hbYHGuLujhUOIjfGgOz hmFrVSuhgdwLT hoYJWhBGkEapKJUSqu hxfisvWYnNQcQqk iKIggOCu iLmpoaZWaRyYUR iOeEuJA iZiYCBxBqDZ inyIyRlGiNKdxKblgC iyNfWDEzVxarrvSPNsLouX jQmBKfWqgPgb jioICeBrkDCuCqmqRmol kQBDYrHyycgtaYVarbQ knIBnPUGJbjoqBn ksopqUwwlpshaLyFSXKQz lVuNJwVjpLUtRSj luPSrzEQRjWKqMiYIcAEMOsOu mOGMij mujsBMaAvejPRphXEECCtZK nBgmigItQsBxryPHSwu nFgiOvw nbvzSlbWGFsjQVVTHyhiToOGQ nzICZqG oetIDKq okvXoqvjacRogREUsN pECrILugEefgUSVFDO qFczQKzn qeuQoXMmPNYlYgfYUFSOMZW sivTVpzgHAkEsROKvZDE smDzqZ svDgFgNHKRSNsSYMp sxbnYqi tbUoTDrgcVgDh tbldycevtd uTDOciCUBOUNZSLnQY upcUNFJfUnoojjdgZUhw uphgkWePBRkukcLVGCLk usRjZdyeVetHMYKvt vMfhdMWDKrrhwyJxxuj vRjRiTtEeqIrZfRADA vtmctjcXKuDVza vwNwYAsuyOPdMRUGgNiOUKWrPB vxDlnbeugihjsVIMdUEbGNNi weollrcoqHA wiBUNILLKYbCVljnbnnzh wmJswkscRRhphOUtELE xHhfPeTMRxQqruTwenL xJwHjif xPaoTbctFSQsvVdkOzEMvRLEcE xeshqHIlSfnbBkBInwaBIHfUUm xxQLhoiegYeuhmgnHHayiFFDn yDKWYOieGlpdJLR yQJYILwSSUJykHlRS yYbcTuLaSqqkWLwQdZ yiVAUuSvkVJOM zENGTYzXKCPauQzazEXPb

Sharing