GraviesSociologism[.]pornographer[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GraviesSociologism.pornographer.dll
Size

651KB
MD5

691372ea34faf3ec89370894afa2ffa1
SHA1

2995ccb346068d6bfee7f5511ae23c7b4f901222
SHA256

455948d008b41a1e3e20f79d47a939c17ab014deda6d1f17420c4184d6564af7
SHA512

5238cf37d752034947a069b9aabd1be531b50deff0c8f95b86b055a0315f102e201c3dfb58d04f05b3d29db646357027ac4cdc8450edbb4051c465d3e280b3b6
SSDEEP

12288:8ECPS1tJLT02+k+GeyE01gbGNc1yrNnEr1xbUbZFlqnVuS99KI26b:8nS1tJnlXDeyEzGNrrRErTbUZFlqf99n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GraviesSociologism.pornographer.dll

Files

GraviesSociologism.pornographer.dll
.dll windows x86

19880b8bd511fabdc69b9d7ebd58f275

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsProcessorFeaturePresent
SetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetCurrentProcessId
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
CloseHandle
DeleteCriticalSection
CreateEventW
WaitForSingleObject

Exports

Exports

q?0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
q?4_Init_locks@std@@QAEAAV01@ABV01@@Z
qXMPDocOps_BranchXMP_1
qXMPDocOps_CTor_1
qXMPDocOps_Clone_1
qXMPDocOps_CreateID_1
qXMPDocOps_DecrementRefCount_1
qXMPDocOps_EnsureIDsExist_1
qXMPDocOps_GetMetaRef_1
qXMPDocOps_GetPartChangeID_1
qXMPDocOps_HasPartChanged_1
qXMPDocOps_IncrementRefCount_1
qXMPDocOps_IsDirty_1
qXMPDocOps_NewXMP_1
qXMPDocOps_NoteChange_1
qXMPDocOps_OpenXMP_1
qXMPDocOps_PrepareForSave_1
qXMPDocOps_SetAppName_1
qXMPIterator_DecrementRefCount_1
qXMPIterator_IncrementRefCount_1
qXMPIterator_Next_1
qXMPIterator_PropCTor_1
qXMPIterator_Skip_1
qXMPIterator_TableCTor_1
qXMPMeta_AppendArrayItem_1
qXMPMeta_CTor_1
qXMPMeta_Clone_1
qXMPMeta_CountArrayItems_1
qXMPMeta_DecrementRefCount_1
qXMPMeta_DeleteArrayItem_1
qXMPMeta_DeleteLocalizedText_1
qXMPMeta_DeleteNamespace_1
qXMPMeta_DeleteProperty_1
qXMPMeta_DeleteQualifier_1
qXMPMeta_DeleteStructField_1
qXMPMeta_DoesArrayItemExist_1
qXMPMeta_DoesPropertyExist_1
qXMPMeta_DoesQualifierExist_1
qXMPMeta_DoesStructFieldExist_1
qXMPMeta_DumpNamespaces_1
qXMPMeta_DumpObject_1
qXMPMeta_DumpPropertyTraits_1
qXMPMeta_Erase_1
qXMPMeta_GetArrayItem_1
qXMPMeta_GetGlobalOptions_1
qXMPMeta_GetLocalizedText_1
qXMPMeta_GetMemProcs_1
qXMPMeta_GetNamespacePrefix_1
qXMPMeta_GetNamespaceURI_1
qXMPMeta_GetObjectName_1
qXMPMeta_GetObjectOptions_1
qXMPMeta_GetProperty_1
qXMPMeta_GetProperty_Bool_1
qXMPMeta_GetProperty_Date_1
qXMPMeta_GetProperty_Float_1
qXMPMeta_GetProperty_Int64_1
qXMPMeta_GetProperty_Int_1
qXMPMeta_GetQualifier_1
qXMPMeta_GetStructField_1
qXMPMeta_GetVersionInfo_1
qXMPMeta_IncrementRefCount_1
qXMPMeta_Initialize_1
qXMPMeta_MarkStaleProperties_1
qXMPMeta_ParseFromBuffer_1
qXMPMeta_RegisterAssertNotify_1
qXMPMeta_RegisterNamespace_1
qXMPMeta_RegisterPropertyTraits_1
qXMPMeta_SerializeToBuffer_1
qXMPMeta_SetArrayItem_1
qXMPMeta_SetGlobalOptions_1
qXMPMeta_SetLocalizedText_1
qXMPMeta_SetObjectName_1
qXMPMeta_SetObjectOptions_1
qXMPMeta_SetProperty_1
qXMPMeta_SetProperty_Bool_1
qXMPMeta_SetProperty_Date_1
qXMPMeta_SetProperty_Float_1
qXMPMeta_SetProperty_Int64_1
qXMPMeta_SetProperty_Int_1
qXMPMeta_SetQualifier_1
qXMPMeta_SetStructField_1
qXMPMeta_Sort_1
qXMPMeta_Terminate_1
qXMPMeta_UnregisterAssertNotify_1
qXMPUtils_AppendProperties_1
qXMPUtils_ApplyTemplate_1
qXMPUtils_CatenateArrayItems_1
qXMPUtils_CollectMultiFileXMP_1
qXMPUtils_CompareDateTime_1
qXMPUtils_ComposeArrayItemPath_1
qXMPUtils_ComposeFieldSelector_1
qXMPUtils_ComposeLangSelector_1
qXMPUtils_ComposeQualifierPath_1
qXMPUtils_ComposeStructFieldPath_1
qXMPUtils_ConvertFromBool_1
qXMPUtils_ConvertFromDate_1
qXMPUtils_ConvertFromFloat_1
qXMPUtils_ConvertFromInt64_1
qXMPUtils_ConvertFromInt_1
qXMPUtils_ConvertToBool_1
qXMPUtils_ConvertToDate_1
qXMPUtils_ConvertToFloat_1
qXMPUtils_ConvertToInt64_1
qXMPUtils_ConvertToInt_1
qXMPUtils_ConvertToLocalTime_1
qXMPUtils_ConvertToUTCTime_1
qXMPUtils_CurrentDateTime_1
qXMPUtils_DecodeFromBase64_1
qXMPUtils_DistributeMultiFileXMP_1
qXMPUtils_DuplicateSubtree_1
qXMPUtils_EncodeToBase64_1
qXMPUtils_GetBulkMarkers_1
qXMPUtils_GetDateRange_1
qXMPUtils_GetMergedListPath_1
qXMPUtils_IsPropertyMultiValued_1
qXMPUtils_MergeFromJPEG_1
qXMPUtils_PackageForJPEG_1
qXMPUtils_RemoveMultiValueInfo_1
qXMPUtils_RemoveProperties_1
qXMPUtils_SeparateArrayItems_1
qXMPUtils_SetBulkMarkers_1
qXMPUtils_SetTimeZone_1
qMP_GetAssertNotify
vips

Sections

.text
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 340KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ