nanodump_ppl_dump[.]x86[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

nanodump_ppl_dump.x86.dll
Size

56KB
MD5

d0749273f8da360e7e93376dc3e0ccd8
SHA1

bc2c4deba40d58b42d236de43ee2cc3756ea003f
SHA256

30f73e1669cab1046d84d8fda29cb260f076cbbd5b548fbb0b9485afa2c95fb3
SHA512

6799a2fd4bcaa34d59ab7405a4412d2de92d69940ffb8891620d047e454aa65c67d0fdd7e67388382b325f20adf006ae9657ec23bf9f48d5e1da8d9dc52c04ca
SSDEEP

768:Flcqb3sh1LlgliZq3kwLOsB6U2rteazJzJEuKg8B999jgE6XrX:Fn7oZmkwLOsZ4tea/PE6bX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nanodump_ppl_dump.x86.dll

Files

nanodump_ppl_dump.x86.dll
.dll windows x86

644b80560d375626959b9d95ed737545

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AttachConsole
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteConsoleA

msvcrt

_amsg_exit
_initterm
_iob
_lock
_unlock
_vscprintf
_vsnprintf
_wcsicmp
abort
calloc
free
fwrite
mbstowcs
memcmp
memcpy
memset
rand
realloc
srand
strlen
strncmp
strncpy
strrchr
vfprintf
time
wcslen
wcsncat
wcsncpy
wcsrchr
wcsstr
wcstombs
wcstoul

Exports

Exports

BriCreateBrokeredEvent@0
BriDeleteBrokeredEvent@0
DllMain@12
EACreateAggregateEvent@0
EADeleteAggregateEvent@0
EAQueryAggregateEventData@0
EaCreateAggregatedEvent@0
EaDeleteAggregatedEvent@0
EaFreeAggregatedEventParameters@0
EaQueryAggregatedEventParameters@0
LogonUserExExW@0

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 453B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

644b80560d375626959b9d95ed737545

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 164B

.rdata Size: 4KB - Virtual size: 4KB

/4 Size: 5KB - Virtual size: 5KB

.bss Size: - Virtual size: 6KB

.edata Size: 512B - Virtual size: 453B

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 40KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 164B

.rdata
Size: 4KB - Virtual size: 4KB

/4
Size: 5KB - Virtual size: 5KB

.bss
Size: - Virtual size: 6KB

.edata
Size: 512B - Virtual size: 453B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1KB - Virtual size: 1KB