dbghelp[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dbghelp.dll
Size

2.7MB
MD5

6133ed266875a3d9bd1f118712841f0d
SHA1

5d4de17c9fb0c12bb006b9b44dd9135eb8100e1a
SHA256

fd5f00bd0d1ab683750ea2e5e17ff0bd2e1cc9b66de24f104cafebbd34e697c0
SHA512

4569881dffe90fd37a7eb304045041f2c2731976f30c5b66ad0358863b11d3e10a1fff2d0c163d8214e0111851c66276432f7d8e5da276cd375d4c6c67ae70d0
SSDEEP

49152:J0BbwoP+8wC/prLM/HkeJ/1MpccXg7WpIdn9aQSg+hu++ioagHW:CnG5CBf+HkeJ/1MpbpIdn9aQX+hu++i7

Score

1^/10

Malware Config

Signatures

Files

dbghelp.dll
.dll windows x64

c58c0e1c1bbd36b803954196714c1c7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

zlib1

inflate
inflateEnd
inflateInit_

kernel32

CloseHandle
CreateDirectoryA
CreateFileA
CreateFileMappingW
CreateFileW
DelayLoadFailureHook
DeviceIoControl
DisableThreadLibraryCalls
DuplicateHandle
FindClose
FindFirstFileW
FindNextFileW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileSizeEx
GetModuleHandleA
GetProcAddress
GetProcessId
GetSystemInfo
GetThreadContext
GetThreadSelectorEntry
GetTickCount
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
HeapValidate
IsBadStringPtrA
IsBadStringPtrW
IsProcessorFeaturePresent
IsWow64Process
K32EnumProcessModules
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
MapViewOfFile
MultiByteToWideChar
OpenThread
RaiseException
ReadFile
ReadProcessMemory
ResolveDelayLoadedAPI
ResumeThread
RtlUnwind
SearchPathA
SearchPathW
SetFilePointer
SetFilePointerEx
SuspendThread
UnmapViewOfFile
VirtualQueryEx
WideCharToMultiByte
WriteFile
lstrcmpW
wine_get_dos_file_name

ntdll

NtQueryInformationProcess
NtQueryInformationThread
NtQuerySystemInformation
RtlComputeCrc32
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlImageRvaToSection
RtlImageRvaToVa
_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
__unDName
_assert
_errno
_strdup
_stricmp
_strtoui64
_time64
_wcsicmp
_wcsnicmp
atoi
atol
free
fwrite
getenv
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
strcat
strchr
strcmp
strcpy
strcspn
strlen
strtol
toupper
towlower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcsstr

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSetSymWithAddr64
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit

Sections

.text
Size: 296KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 676KB - Virtual size: 674KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c58c0e1c1bbd36b803954196714c1c7b

Headers

DLL Characteristics

File Characteristics

Imports

zlib1

kernel32

ntdll

ucrtbase

Exports

Exports

Sections

.text Size: 296KB - Virtual size: 292KB

.data Size: 4KB - Virtual size: 864B

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 52KB - Virtual size: 49KB

.pdata Size: 8KB - Virtual size: 6KB

.xdata Size: 12KB - Virtual size: 8KB

.bss Size: - Virtual size: 35KB

.edata Size: 16KB - Virtual size: 15KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 960B

.reloc Size: 4KB - Virtual size: 304B

/4 Size: 4KB - Virtual size: 1KB

/19 Size: 1.1MB - Virtual size: 1.1MB

/31 Size: 48KB - Virtual size: 46KB

/45 Size: 244KB - Virtual size: 243KB

/57 Size: 72KB - Virtual size: 68KB

/70 Size: 32KB - Virtual size: 29KB

/81 Size: 676KB - Virtual size: 674KB

/92 Size: 116KB - Virtual size: 115KB

.text
Size: 296KB - Virtual size: 292KB

.data
Size: 4KB - Virtual size: 864B

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 52KB - Virtual size: 49KB

.pdata
Size: 8KB - Virtual size: 6KB

.xdata
Size: 12KB - Virtual size: 8KB

.bss
Size: - Virtual size: 35KB

.edata
Size: 16KB - Virtual size: 15KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 960B

.reloc
Size: 4KB - Virtual size: 304B

/4
Size: 4KB - Virtual size: 1KB

/19
Size: 1.1MB - Virtual size: 1.1MB

/31
Size: 48KB - Virtual size: 46KB

/45
Size: 244KB - Virtual size: 243KB

/57
Size: 72KB - Virtual size: 68KB

/70
Size: 32KB - Virtual size: 29KB

/81
Size: 676KB - Virtual size: 674KB

/92
Size: 116KB - Virtual size: 115KB