14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll
Size 2.7MB
Sample220902-mbc4saccbq
SHA256 14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7
MD5 69c76434973e66a083b2fc19c8b9107a
SHA1 9b2769e2febf5f6867e5fb4eaa682271d5d04c99
SHA512 fbfc44d9b08a6d0e5aea6c65b850d442e6a6a435c64153e9a01932c7071061a272db8428f74e17582f3636acb6eea3a32bcea83eec209abefc9385b7c755ed1b
SSDEEP 49152:NAWpf9CQFUzyJZnuEmamAiZTLVmUPbApIJkw:NApQKzCZurxLVmUPbAAH
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll

.dll 2.7MB

14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll

IMPHASH fce537f90e196225b462ce4019d18db4
SHA256 14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7
MD5 69c76434973e66a083b2fc19c8b9107a
SHA1 9b2769e2febf5f6867e5fb4eaa682271d5d04c99
SHA512 fbfc44d9b08a6d0e5aea6c65b850d442e6a6a435c64153e9a01932c7071061a272db8428f74e17582f3636acb6eea3a32bcea83eec209abefc9385b7c755ed1b
SSDEEP 49152:NAWpf9CQFUzyJZnuEmamAiZTLVmUPbApIJkw:NApQKzCZurxLVmUPbAAH
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

2147531

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter HeapSize GetPrivateProfileStringA K32GetModuleFileNameExA TerminateProcess OpenProcess Process32First FindFirstFileA DeviceIoControl FindNextFileA GetVolumeInformationA GetModuleHandleA CreateToolhelp32Snapshot GlobalSize GlobalAlloc HeapReAlloc GetNativeSystemInfo GlobalLock GlobalMemoryStatusEx GlobalUnlock VirtualProtect K32GetModuleInformation HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI LoadLibraryA GetTickCount Sleep GetTempPathA Process32Next MultiByteToWideChar lstrcmpiW DeleteCriticalSection DecodePointer RaiseException GetLastError FlushFileBuffers WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx CopyFileW MoveFileExW GetFileInformationByHandleEx GetExitCodeThread QueryPerformanceFrequency GetStringTypeW LCMapStringEx EncodePointer GetModuleHandleW CompareStringEx GetCPInfo IsDebuggerPresent SetLastError SleepEx GetSystemDirectoryW GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleFileNameW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA InitializeCriticalSectionEx

user32

wsprintfA ReleaseDC GetDC EnumDisplayDevicesA GetSystemMetrics GetDesktopWindow

gdi32

StretchBlt SetStretchBltMode CreateCompatibleBitmap SelectObject CreateCompatibleDC GetCurrentObject GetDIBits DeleteDC GetObjectW

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash RegQueryValueExA CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExA RegEnumKeyExA GetUserNameA RegGetValueA RegCloseKey

shell32

ShellExecuteA

ole32

GetHGlobalFromStream CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CLSIDFromString

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptUnprotectData CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream

urlmon

URLDownloadToFileA

ws2_32

getsockopt htons getpeername setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockname ntohs

wldap32

ord167 ord301 ord147 ord133 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord216 ord14 ord46 ord219 ord145 ord79 ord142