xFish[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

xFish.dll
Size

10KB
MD5

9737f44df490ca7c4e228da42f535002
SHA1

9d8d25f441d0dd9eb0afa29cfec01ad6d6d352f1
SHA256

80b5c3ef4533c39e7d33354ee17d5bd4a24454a271a5b6391870ab0f0fd523da
SHA512

ad21cc19a1575655c2d5f33651e262669d98d8451dad9ce8ee0def056657293c78cab4589320c1ba174467ced885c7768a2b66a8e61e62266c13c0b27a8163b4
SSDEEP

192:BGBDhbBx85LZD5Z2PFVhJHJAyZJg8D0KThxA+rAQE+tnJiO:Q3JpJgLa0Mp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xFish.dll

Files

xFish.dll
.dll windows x86

bc7b19e4d41d802dbc97ff4e8fbe48ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetProcessHeap
lstrlenA
lstrcpyA
HeapAlloc

user32

wsprintfA

Exports

Exports

Decrypt
Encrypt

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 329B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ