378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22.dll
Size

96KB
MD5

85340e1406b3ec6e4f46c66e046d6fd0
SHA1

f472f3e892774dc7de180fc503f96c7ae05d7d39
SHA256

378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22
SHA512

33dc44399c2cf0a19a789327d8292091a15cc750eaa5a4c36f6fa3f86e1983e668620ef63a78a4f59cf91dfba1f5059ac773b00b4cab6892bf3e7a03a6b1f8c9
SSDEEP

1536:otR5VyhFNqGHvPkNddinDZjf7a5ziq92ndHNBl/M7PL6B:k9ezHvPk8+5GnJNn/M7PL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22.dll

Files

378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22.dll
.dll windows x86

45a78b23e0a981eb1134ad40a6d2f25d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
NtOpenProcess
NtQueryVirtualMemory
RtlAllocateHeap
RtlReAllocateHeap
NtOpenThread
LdrGetDllHandle
RtlDestroyHeap
RtlInitUnicodeString
RtlFreeHeap
NtQueryInformationThread
RtlCreateHeap
NtProtectVirtualMemory
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSuspendThread
NtGetContextThread
NtFlushInstructionCache
NtSetContextThread
NtResumeThread
RtlGetNtVersionNumbers
RtlMoveMemory
NtQueryInformationProcess
NtQuerySystemInformation
NtTerminateProcess
NtTerminateThread
RtlZeroMemory
RtlRandom
NtClose

kernel32

Sleep
CopyFileW
FormatMessageW
GetModuleFileNameW
lstrcmpW
MultiByteToWideChar
lstrlenW
GetLastError
SetLastError
GetComputerNameExW
DisableThreadLibraryCalls
FindClose
LoadLibraryA
CreateFileMappingW
CreateEventW
SetCurrentDirectoryW
WaitForMultipleObjects
CreatePipe
WTSGetActiveConsoleSessionId
lstrcmpiW
lstrcatW
FindNextFileW
SetEndOfFile
GetCurrentThreadId
GetDiskFreeSpaceExW
DeleteFileW
LocalFree
GetSystemTime
lstrcpyW
CreateThread
ExpandEnvironmentStringsW
HeapReAlloc
GetNativeSystemInfo
TerminateProcess
GetCurrentDirectoryW
GetProcAddress
HeapSize
GetLocaleInfoW
LCMapStringW
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetCommandLineA
DecodePointer
UnmapViewOfFile
LoadLibraryW
WideCharToMultiByte
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetModuleHandleW
SetEvent
WaitForSingleObject
HeapFree
MapViewOfFile
SetEnvironmentVariableW
LoadLibraryExW
HeapAlloc
CreateProcessW
GetStringTypeW
FreeLibrary
FindFirstFileW
GetCommandLineW
ExitProcess
lstrcpyA
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
GetProcessHeap
GetTickCount
MoveFileExW
SetFilePointer
CreateFileA
OpenEventW
IsProcessorFeaturePresent

user32

GetWindowThreadProcessId
GetWindowTextW
CreateDesktopW
DestroyWindow
GetWindowRect
PostQuitMessage
GetThreadDesktop
wsprintfW
CallWindowProcW
SetTimer
DispatchMessageW
GetForegroundWindow
SendMessageW
KillTimer
GetMessageW
PostMessageW
SetForegroundWindow
wsprintfA
ExitWindowsEx
CloseDesktop
CharLowerW
GetDC
GetWindowTextA
BringWindowToTop
GetWindowLongW
GetClassNameW
ReleaseDC
SetWindowLongW
GetDesktopWindow
SetWindowPos
LoadStringW
GetLastInputInfo
SwitchDesktop
SetThreadDesktop
PostThreadMessageW

shlwapi

PathRemoveArgsW
PathAddExtensionW
PathRemoveExtensionW
StrToIntW
StrChrA
StrCmpNIW
SHDeleteKeyW
StrRChrW
PathFindFileNameW
PathIsRelativeW
PathRemoveFileSpecW
PathAddBackslashW
PathFindFileNameA
PathAddBackslashA
StrTrimA
StrDupA
ord12
PathFindExtensionW
PathRemoveFileSpecA

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

advapi32

RegDeleteValueW
GetNamedSecurityInfoW
LsaClose
QueryServiceStatus
DuplicateTokenEx
StartServiceW
GetSecurityInfo
ChangeServiceConfig2W
LookupPrivilegeValueW
SetNamedSecurityInfoW
RegDeleteKeyW
DuplicateToken
CreateProcessAsUserW
RegQueryValueExW
RegCreateKeyExW
GetTokenInformation
RegisterServiceCtrlHandlerExW
OpenServiceW
LsaOpenPolicy
GetUserNameW
LogonUserW
OpenSCManagerW
DeleteService
IsWellKnownSid
LsaQueryInformationPolicy
OpenProcessToken
CloseServiceHandle
CreateServiceW
ChangeServiceConfigW
AllocateAndInitializeSid
SetServiceStatus
FreeSid
CheckTokenMembership
ControlService
AdjustTokenPrivileges
ConvertSidToStringSidW
QueryServiceConfigW
RegCloseKey
RegSetValueExW
LsaFreeMemory
CreateWellKnownSid
RegOpenKeyExW
EnumServicesStatusExW
SetSecurityInfo
QueryServiceStatusEx
SetEntriesInAclW

ws2_32

closesocket
socket

shell32

CommandLineToArgvW
ShellExecuteExW
SHCreateDirectoryExW

gdi32

StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
BitBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap

cabinet

ord22
ord23
ord21
ord20

oleaut32

SysFreeString
VariantInit
SysAllocString

ole32

CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitializeEx

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

TransparentBltEx

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45a78b23e0a981eb1134ad40a6d2f25d

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

shlwapi

wtsapi32

userenv

advapi32

ws2_32

shell32

gdi32

cabinet

oleaut32

ole32

version

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 6KB - Virtual size: 5KB