7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb[.]dll

Resubmissions

11/06/2023, 11:52

230611-n1ty9shg3v 3

11/06/2023, 11:27

230611-nkxefsha66 3

Sharing

Copy URL Twitter E-mail

General

Target

7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb.dll
Size

1.8MB
MD5

67b447f52eaa9e133b19d7954dad18c8
SHA1

805d0d48bf12bb8cadeccedb87b47479063d6546
SHA256

7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb
SHA512

7be92768079de4fd513c10320fa8221788bb79c4329d222c8a17ed63d6b71182b82efa259005e73f4fb4f6f688ee8ecf390ca535f3b633469ab310332cdb7973
SSDEEP

24576:mJj+2WjaHEFyYzL3xfD6O35/feXqedLssO/krYPeT8u2IbMqkwXLcm:mJj8js8dbz5/aqedLsNbPqMR+Lcm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb.dll

Files

7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb.dll
.dll windows x64

680cde4a08e94128b04ec18b5b932427

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AcquireSRWLockShared
CancelIoEx
ChangeTimerQueueTimer
CloseHandle
CommConfigDialogW
ConnectNamedPipe
CreateActCtxW
CreateDirectoryW
CreateEventA
CreateEventExW
CreateEventW
CreateFileA
CreateFileW
CreateHardLinkTransactedW
CreateMutexA
CreateMutexW
CreateNamedPipeA
CreatePipe
CreateProcessW
CreateRemoteThread
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteTimerQueueTimer
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumDateFormatsW
EnumSystemCodePagesA
EnumSystemLanguageGroupsW
EnumSystemLocalesW
ExitProcess
ExitThread
FileTimeToDosDateTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsGetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCPInfoExA
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOriginalTitleW
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDevicePowerState
GetDynamicTimeZoneInformation
GetEnvironmentStringsW
GetFileAttributesW
GetFileSize
GetFileType
GetLargePageMinimum
GetLastError
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameTransactedA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetNumaProximityNode
GetOEMCP
GetOverlappedResult
GetPrivateProfileStringA
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessId
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemFileCacheSize
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GetUserDefaultLCID
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCIDToLocaleName
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
MultiByteToWideChar
OpenPrivateNamespaceA
OpenProcess
OpenThread
Process32FirstW
Process32NextW
ProcessIdToSessionId
QueryActCtxW
QueryDepthSList
QueryFullProcessImageNameW
QueryIdleProcessorCycleTime
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockShared
ReleaseSemaphore
RequestDeviceWakeup
RequestWakeupLatency
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetCalendarInfoW
SetConsoleHistoryInfo
SetCurrentDirectoryW
SetDefaultCommConfigW
SetDynamicTimeZoneInformation
SetEvent
SetFilePointerEx
SetHandleInformation
SetLastError
SetLocaleInfoA
SetStdHandle
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SignalObjectAndWait
Sleep
SleepEx
SuspendThread
SwitchToThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnregisterApplicationRecoveryCallback
UnregisterWait
UnregisterWaitEx
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualUnlock
WaitCommEvent
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
Wow64DisableWow64FsRedirection
Wow64GetThreadContext
Wow64RevertWow64FsRedirection
Wow64SetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory

shell32

CommandLineToArgvW
DuplicateIcon
ExtractIconW
SHFileOperationW
SHGetDiskFreeSpaceExW
SHQueryRecycleBinA
SHSetUnreadMailCountW
ord245

advapi32

AdjustTokenPrivileges
CreateProcessAsUserW
CreateProcessWithTokenW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DuplicateTokenEx
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetUserNameW
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
LogonUserW
LookupAccountSidW
LookupPrivilegeValueW
OpenProcessToken
PrivilegeCheck
RevertToSelf
SetSecurityDescriptorDacl

gdi32

CloseMetaFile
CopyMetaFileW
CreateBitmapIndirect
CreateColorSpaceW
CreateEnhMetaFileA
DescribePixelFormat
ExtCreatePen
ExtEscape
GdiGradientFill
GdiSetBatchLimit
GetClipRgn
GetDCBrushColor
GetDeviceGammaRamp
GetEnhMetaFileA
GetEnhMetaFileDescriptionA
GetGlyphOutlineW
GetGraphicsMode
GetICMProfileA
GetLogColorSpaceA
GetMetaRgn
GetObjectType
GetOutlineTextMetricsA
GetTextExtentExPointA
GetTextExtentExPointI
GetViewportExtEx
PathToRegion
SelectPalette
SetDCPenColor
SetMiterLimit
SetPixelV
SetTextJustification
StartDocW
TranslateCharsetInfo

user32

ActivateKeyboardLayout
AnimateWindow
ArrangeIconicWindows
AttachThreadInput
ChangeDisplaySettingsW
CharToOemA
CharUpperA
ClientToScreen
CopyRect
CreateWindowExA
DeferWindowPos
DialogBoxIndirectParamA
DlgDirListW
DragDetect
DrawMenuBar
EnumDesktopsW
EnumPropsExA
EnumThreadWindows
FlashWindow
GetClassNameA
GetDlgItem
GetDlgItemTextA
GetFocus
GetKeyboardType
GetMenuItemInfoA
GetMonitorInfoA
GetNextDlgGroupItem
GetRawInputData
GetUpdatedClipboardFormats
InflateRect
InvalidateRect
IsCharAlphaW
IsCharLowerA
IsMenu
IsProcessDPIAware
IsWindow
LoadMenuW
MapDialogRect
MessageBoxIndirectW
MonitorFromRect
OemToCharA
OemToCharBuffW
OffsetRect
OpenDesktopA
RealChildWindowFromPoint
RemoveMenu
SetCapture
SetClassLongA
SetCursor
SetPhysicalCursorPos
SetProcessWindowStation
SetPropA
SetRectEmpty
SetSystemCursor
ShowCaret
TileWindows
TrackPopupMenu
UpdateWindow
wvsprintfW

secur32

GetUserNameExW

dxva2

GetMonitorRedGreenOrBlueGain
GetNumberOfPhysicalMonitorsFromIDirect3DDevice9
SaveCurrentMonitorSettings
SetMonitorColorTemperature

rpcrt4

UuidCreate

ws2_32

GetNameInfoW
WSAGetLastError
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
recv
send
shutdown
socket

iphlpapi

GetAdaptersAddresses
GetBestInterfaceEx

shlwapi

PathFindFileNameW
StrRStrIA

winhttp

WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption

userenv

CreateEnvironmentBlock

Exports

Exports

sqlite3_close
sqlite3_column_count
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_text
sqlite3_column_text16
sqlite3_exec
sqlite3_finalize
sqlite3_free
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_reset
sqlite3_step

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

680cde4a08e94128b04ec18b5b932427

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

advapi32

gdi32

user32

secur32

dxva2

rpcrt4

ws2_32

iphlpapi

shlwapi

winhttp

userenv

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 279KB - Virtual size: 278KB

.data Size: 13KB - Virtual size: 102KB

.pdata Size: 67KB - Virtual size: 67KB

.00cfg Size: 512B - Virtual size: 16B

.gehcont Size: 512B - Virtual size: 16B

.rsrc Size: 512B - Virtual size: 424B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 279KB - Virtual size: 278KB

.data
Size: 13KB - Virtual size: 102KB

.pdata
Size: 67KB - Virtual size: 67KB

.00cfg
Size: 512B - Virtual size: 16B

.gehcont
Size: 512B - Virtual size: 16B

.rsrc
Size: 512B - Virtual size: 424B

.reloc
Size: 5KB - Virtual size: 4KB