otv2[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

otv2.dll
Size

1.6MB
MD5

e3c18dd5c84dc9b9ca5bf0aa10d26f95
SHA1

2f17493f23e9aee959f90c66db2e71c08328bfde
SHA256

8c5563f28d7e630c746f7ece68e8c7b9c8abf952f195bd8d69f8e96c3cf21fdf
SHA512

897093c5c6dda669996425ef8d0ecf50f3749145e899744409cfbb6dde23c68816d90757dfc90dd519b443d339aad4eff78d2461cb8344f72e1cdedb1c7f85e2
SSDEEP

49152:rfNunO7TbwVQc6A5RY7kw2R5TU2yqDCfFhdjN22Lj:TNunO7TbwVz6UY7kwApyqDCfjdT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
otv2.dll

Files

otv2.dll
.dll windows x86

Password: e

250a6454a31b8bb10418492cb9057108

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisableThreadLibraryCalls
LoadLibraryA
CloseHandle
CreateThread
GetProcAddress
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
EnterCriticalSection
TerminateProcess

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

memmove
__std_exception_copy
strstr
memset
_CxxThrowException
_except_handler4_common
memcpy
__std_exception_destroy
__CxxFrameHandler3
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-string-l1-1-0

isdigit
tolower

api-ms-win-crt-runtime-l1-1-0

_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_cexit
_crt_atexit
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: e

250a6454a31b8bb10418492cb9057108

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 964B

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 964B