022cb[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

022cb.dll
Size

24KB
MD5

b0c2fa35d14a9fad919e99d9d75e1b9e
SHA1

8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256

022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512

a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
SSDEEP

384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL

Score

N/A

Malware Config

Signatures

Files

022cb.dll
.exe windows x64

0235ff9a007804882636bcccfb4d1a2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

wprintf
?terminate@@YAXXZ
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcsncpy_s
strcat_s
__wargv
__C_specific_handler
_fmode
swprintf_s
wcscat_s
wcscpy_s
_wsplitpath_s
__argc
_commode
memset

ntdll

RtlCaptureContext
EtwEventWriteNoRegistration
RtlWow64IsWowGuestMachineSupported
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetErrorMode
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcess
CreateProcessW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
LoadStringW
GetProcAddress

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetTickCount

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-file-l1-1-0

ReadFile
CreateFileW
SetFilePointer

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-misc-l1-1-0

lstrcmpW
LocalAlloc

api-ms-win-core-kernel32-private-l1-1-0

Wow64EnableWow64FsRedirection

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W
IsWow64Process2

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0235ff9a007804882636bcccfb4d1a2f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-kernel32-private-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 512B - Virtual size: 384B

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 512B - Virtual size: 384B

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 68B