EGloe[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

EGloe.dat
Size

921KB
MD5

31893a60c292a9a72ca9d7231f8945eb
SHA1

0a02c4b0e518fa44c1b4c3830d1b0da6c1aa5702
SHA256

c18d497ecc35bc2721e9b25017837a8ada4e4bbe6e4486953598d952907f684d
SHA512

e65dc83a079436268ebb844436f4dd07107a2ba2dfd4398836f6e859d2c8f2f86090938b82144b3d00c34a8db9cbd26a589b1c43a83251d60b01b301f67ae1d2
SSDEEP

12288:COysJ5nhFvhxaiz8hC6CSvqdRcVU2cQpbls6csdCVsM3c:fhFhxaizH6CCqdRcRcQpbxFCi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EGloe.dat

Files

EGloe.dat
.dll windows x86

69b5a2b4c355363112fef443743090f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RaiseException
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
HeapSize
LCMapStringW
RtlUnwind
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW

Exports

Exports

afloor_P
amapping_P
aresidue_P
agg_packet_clear
agg_page_bos
agg_page_checksum_set
agg_page_continued
agg_page_eos
agg_page_granulepos
agg_page_packets
agg_page_pageno
agg_page_serialno
agg_page_version
agg_stream_clear
agg_stream_destroy
agg_stream_eos
agg_stream_flush
agg_stream_init
agg_stream_packetin
agg_stream_packetout
agg_stream_packetpeek
agg_stream_pagein
agg_stream_pageout
agg_stream_reset
agg_stream_reset_serialno
agg_sync_buffer
agg_sync_clear
agg_sync_destroy
agg_sync_init
agg_sync_pageout
agg_sync_pageseek
agg_sync_reset
agg_sync_wrote
aggpackB_adv
aggpackB_adv1
aggpackB_bits
aggpackB_bytes
aggpackB_get_buffer
aggpackB_look
aggpackB_look1
aggpackB_read
aggpackB_read1
aggpackB_readinit
aggpackB_reset
aggpackB_write
aggpackB_writealign
aggpackB_writeclear
aggpackB_writecopy
aggpackB_writeinit
aggpackB_writetrunc
aggpack_adv
aggpack_adv1
aggpack_bits
aggpack_bytes
aggpack_get_buffer
aggpack_look
aggpack_look1
aggpack_read
aggpack_read1
aggpack_readinit
aggpack_reset
aggpack_write
aggpack_writealign
aggpack_writeclear
aggpack_writecopy
aggpack_writeinit
aggpack_writetrunc
aorbis_analysis
aorbis_analysis_blockout
aorbis_analysis_buffer
aorbis_analysis_headerout
aorbis_analysis_init
aorbis_analysis_wrote
aorbis_bitrate_addblock
aorbis_bitrate_flushpacket
aorbis_block_clear
aorbis_block_init
aorbis_comment_add
aorbis_comment_add_tag
aorbis_comment_clear
aorbis_comment_init
aorbis_comment_query
aorbis_comment_query_count
aorbis_commentheader_out
aorbis_dsp_clear
aorbis_encode_ctl
aorbis_encode_init
aorbis_encode_init_vbr
aorbis_encode_setup_init
aorbis_encode_setup_managed
aorbis_encode_setup_vbr
aorbis_granule_time
aorbis_info_blocksize
aorbis_info_clear
aorbis_info_init
aorbis_packet_blocksize
aorbis_synthesis
aorbis_synthesis_blockin
aorbis_synthesis_halfrate
aorbis_synthesis_halfrate_p
aorbis_synthesis_headerin
aorbis_synthesis_idheader
aorbis_synthesis_init
aorbis_synthesis_lapout
aorbis_synthesis_pcmout
aorbis_synthesis_read
aorbis_synthesis_restart
aorbis_synthesis_trackonly
aorbis_version_string
bind

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 617KB - Virtual size: 617KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69b5a2b4c355363112fef443743090f1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

.rdata Size: 617KB - Virtual size: 617KB

.data Size: 5KB - Virtual size: 12KB

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 112KB - Virtual size: 110KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 165KB - Virtual size: 164KB

.rdata
Size: 617KB - Virtual size: 617KB

.data
Size: 5KB - Virtual size: 12KB

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 112KB - Virtual size: 110KB

.reloc
Size: 13KB - Virtual size: 12KB