b26bbe590caac12efcf76a1d62b390aa[.]dll

Resubmissions

22/09/2022, 16:57

220922-vga6dabhg710

22/09/2022, 16:56

220922-vf4rasfgaq10

22/09/2022, 16:48

220922-va6cyabhf98

13/09/2022, 17:49

220913-wd1sascabl8

Sharing

Copy URL Twitter E-mail

General

Target
b26bbe590caac12efcf76a1d62b390aa.dll
Size 2.7MB
Sample220913-wd1sascabl
SHA256 4ea86098be9e4fd932758729fbe6c7fd4c53babf228388b24f8b263ebccf56f4
MD5 b26bbe590caac12efcf76a1d62b390aa
SHA1 8027ce80904f287ee72ceee68a0ec95dddf309ac
SHA512 f5ac91af8fb36d990082ccab8f2ba130ac2cdfd1c3d29e6dd26be4ae59346fde3c98eb1c08c80f7e44b22ac33f5ab60ef8216fb54dfe0eb8e8245297e7f9f774
SSDEEP 49152:94j4pRhvvWPcqysG2ZLyZMCWH+DGeQwa:CjcvWPcqZHcZMCWH+Kt3
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

b26bbe590caac12efcf76a1d62b390aa.dll

.dll 2.7MB

b26bbe590caac12efcf76a1d62b390aa.dll

IMPHASH c0d46b7ff0e53996feb53e4ba78f033e
SHA256 4ea86098be9e4fd932758729fbe6c7fd4c53babf228388b24f8b263ebccf56f4
MD5 b26bbe590caac12efcf76a1d62b390aa
SHA1 8027ce80904f287ee72ceee68a0ec95dddf309ac
SHA512 f5ac91af8fb36d990082ccab8f2ba130ac2cdfd1c3d29e6dd26be4ae59346fde3c98eb1c08c80f7e44b22ac33f5ab60ef8216fb54dfe0eb8e8245297e7f9f774
SSDEEP 49152:94j4pRhvvWPcqysG2ZLyZMCWH+DGeQwa:CjcvWPcqZHcZMCWH+Kt3
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

2196233

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter HeapSize GetPrivateProfileStringA K32GetModuleFileNameExA TerminateProcess OpenProcess Process32First FindFirstFileA DeviceIoControl FindNextFileA GetVolumeInformationA GetModuleHandleA CreateToolhelp32Snapshot GlobalSize GlobalAlloc HeapReAlloc GetNativeSystemInfo GlobalLock GlobalMemoryStatusEx GlobalUnlock VirtualProtect K32GetModuleInformation CreateThread HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI LoadLibraryA GetTickCount Sleep GetTempPathA Process32Next MultiByteToWideChar lstrcmpiW DeleteCriticalSection DecodePointer RaiseException GetLastError FlushFileBuffers WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx CopyFileW MoveFileExW GetFileInformationByHandleEx GetExitCodeThread QueryPerformanceFrequency GetStringTypeW LCMapStringEx EncodePointer GetModuleHandleW CompareStringEx GetCPInfo IsDebuggerPresent SetLastError SleepEx GetSystemDirectoryW GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleFileNameW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA InitializeCriticalSectionEx

user32

ReleaseDC GetDC EnumDisplayDevicesA GetSystemMetrics GetDesktopWindow

gdi32

StretchBlt SetStretchBltMode CreateCompatibleBitmap SelectObject CreateCompatibleDC GetCurrentObject GetDIBits DeleteDC GetObjectW

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash RegQueryValueExA CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExA GetUserNameA RegGetValueA RegCloseKey

shell32

ShellExecuteA

ole32

GetHGlobalFromStream CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CLSIDFromString

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptUnprotectData CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream

urlmon

URLDownloadToFileA

ws2_32

getsockopt htons getpeername setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockname ntohs

wldap32

ord167 ord301 ord147 ord133 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord216 ord14 ord46 ord219 ord145 ord79 ord142