Cmdline[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Cmdline.dll
Size

62KB
MD5

022e81e0fae5e1d727b413b3a746a300
SHA1

b85eb210377a9335c795baa8462f6796129ddb4f
SHA256

daa35b374c9a86352c47ecdacb9429a95cbe0b5eee06b4023d52682d6e132227
SHA512

67bd938a464a0b5070912a3c5e127bfc450a9122303e0cda62b539a70500a7b620124c96fb1751db0635adb6d8b4988dc0eca44199ededfeebd43431e32a7796
SSDEEP

1536:GzjDey5yms6V2xodhMhT/8qZ028ak5fcT0GsGJW2:GHDeyJs6V22dSsfc1W2

Score

N/A

Malware Config

Signatures

Files

Cmdline.dll
.dll windows x86

579abc59a4397386f6b066abf5b0a808

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ollydbg.exe

_Addtolist
_Animate
_Assemble
_Broadcast
_Createwatchwindow
_Deletebreakpoints
_Deletehardwarebreakbyaddr
_Deletenamerange
_Dumpbackup
_Expression
_Findalldllcalls
_Findlabel
_Findmemory
_Findthread
_Getcputhreadid
_Getstatus
_Go
_Hardbreakpoints
_Insertname
_Insertwatch
_OpenEXEfile
_Plugingetvalue
_Pluginreadintfromini
_Pluginsaverecord
_Pluginwriteinttoini
_Registerpluginclass
_Runtracesize
_Sendshortcut
_Setbreakpoint
_Setcpu
_Setdumptype
_Sethardwarebreakpoint
_Setmembreakpoint
_Settracecondition
_Startruntrace
_Unregisterpluginclass
_Writememory

kernel32

CloseHandle
CreateFileA
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
LCMapStringA
LCMapStringW
LoadLibraryA
MultiByteToWideChar
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile

gdi32

CreateSolidBrush
DeleteObject

user32

BeginPaint
CallWindowProcA
ChildWindowFromPoint
CreateWindowExA
DefWindowProcA
EndPaint
EnumThreadWindows
FillRect
GetClientRect
GetSysColor
GetSystemMetrics
GetWindowRect
GetWindowTextA
MessageBoxA
SendMessageA
SetFocus
SetForegroundWindow
SetWindowLongA
SetWindowTextA
WinHelpA
wsprintfA

Exports

Exports

_ODBG_Pluginaction
_ODBG_Pluginclose
_ODBG_Plugincmd
_ODBG_Plugindata
_ODBG_Plugindestroy
_ODBG_Plugininit
_ODBG_Pluginmainloop
_ODBG_Pluginmenu
_ODBG_Pluginreset
_ODBG_Pluginsaveudd
_ODBG_Pluginshortcut
_ODBG_Pluginuddrecord
___CPPdebugHook

Sections

.text
Size: 40KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

579abc59a4397386f6b066abf5b0a808

Headers

File Characteristics

Imports

ollydbg.exe

kernel32

gdi32

user32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 44KB

.data Size: 12KB - Virtual size: 24KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 44KB

.data
Size: 12KB - Virtual size: 24KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 4KB