5DA1AC7EE62BAE0639497F13D93D05DD[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

5DA1AC7EE62BAE0639497F13D93D05DD.dll
Size

19.5MB
MD5

5da1ac7ee62bae0639497f13d93d05dd
SHA1

540f4d2fc161db627cb718e3af770a9494a3061d
SHA256

781bab2073b133a9bfba07e77e200156f2014d3dfd9c66ae77ee47ba27a9e87d
SHA512

b1a5b0ed7ce200fa6a1ee4f80415f895b2bea69d2b44973ccaff2b83fbfdd020cf0b8dbcf5911faeb51248632508038f70458953356a25bd783808c009b586fa
SSDEEP

49152:djJY8xOgZIdqZWAYM+c6Wc9u/3hAfiUSGtit8XwvuthEv9ixsIUAGprNMlKt6TW5:DY8UTopNHFjXzHSxcVpDPe8M9Fn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5DA1AC7EE62BAE0639497F13D93D05DD.dll

Files

5DA1AC7EE62BAE0639497F13D93D05DD.dll
.dll windows x64

85d779e5615d599529f7e930def76fe9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msi

ord256
ord121
ord8
ord145
ord74
ord63
ord120
ord92
ord103
ord124
ord163
ord266
ord125
ord17
ord160
ord159
ord32
ord70
ord49

kernel32

LCMapStringA
LoadLibraryA
ExpandEnvironmentStringsW
ReleaseMutex
InitializeCriticalSection
GetStdHandle
WriteConsoleW
VirtualQuery
GetEnvironmentStrings
FreeEnvironmentStringsA
GetEnvironmentVariableA
FileTimeToLocalFileTime
GetVolumeInformationA
SetErrorMode
GetProcessHeap
GetProcessTimes
GetCurrentProcess
GetCurrentThread
GetThreadTimes
GetSystemInfo
GetSystemTime
GetTickCount
GetVersionExA
GlobalMemoryStatus
GetCommandLineW
VirtualQueryEx
ReadProcessMemory
GlobalFree
lstrcpynW
GetFileInformationByHandle
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesExW
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
CreateDirectoryExW
CopyFileExW
AreFileApisANSI
GetLocaleInfoW
GetTimeZoneInformation
WriteFile
GetDiskFreeSpaceW
MapViewOfFile
UnmapViewOfFile
ResetEvent
GetExitCodeThread
SystemTimeToTzSpecificLocalTime
GetUserDefaultLCID
GetTimeFormatW
FindClose
FindNextFileW
OpenMutexW
OpenFileMappingW
FindFirstFileExW
HeapAlloc
HeapFree
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetLocaleInfoEx
IsProcessorFeaturePresent
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
RtlPcToFileHeader
SwitchToThread
WaitForSingleObjectEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetConsoleCtrlHandler
ExitThread
FreeLibraryAndExitThread
SetStdHandle
ExitProcess
GetConsoleCP
SetEnvironmentVariableW
GetConsoleOutputCP
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetStringTypeExA
SystemTimeToFileTime
FileTimeToSystemTime
LoadLibraryExW
GetDateFormatW
Sleep
HeapReAlloc
CreateWaitableTimerW
CreateProcessW
ReadConsoleInputW
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
GetExitCodeProcess
OpenProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetCurrentThreadId
PeekNamedPipe
SetHandleInformation
CreatePipe
GetComputerNameExW
MultiByteToWideChar
DeleteFileW
TlsSetValue
TlsGetValue
LoadLibraryW
FreeLibrary
ReadFile
SetLastError
GetQueuedCompletionStatus
SetWaitableTimer
CreateIoCompletionPort
SleepEx
GetCurrentProcessId
MoveFileExW
TlsFree
CopyFileW
GetTempFileNameW
PostQueuedCompletionStatus
SetEvent
TerminateThread
WaitForMultipleObjects
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
TlsAlloc
LocalFree
WideCharToMultiByte
FormatMessageW
FormatMessageA
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
LCMapStringEx
FindFirstFileW
RtlUnwind

user32

EnumChildWindows
SendMessageW
MessageBoxA
MessageBoxW
GetClassNameW
LoadStringA
wsprintfW
GetActiveWindow
GetProcessWindowStation
GetUserObjectInformationW
FindWindowW

ws2_32

listen
WSASocketW
WSASend
gethostbyaddr
closesocket
WSAGetLastError
shutdown
WSACleanup
select
htonl
getsockname
WSAIoctl
getsockopt
recv
gethostname
WSARecv
connect
__WSAFDIsSet
bind
WSASetLastError
accept
WSAStringToAddressW
htons
ntohl
setsockopt
WSAAddressToStringW
gethostbyname
inet_addr
getservbyname
inet_ntoa
getservbyport
WSAAddressToStringA
WSAStringToAddressA
ioctlsocket
send
ntohs
WSAStartup

comdlg32

GetOpenFileNameW
CommDlgExtendedError

advapi32

CryptSignHashW
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
EqualSid
RegQueryInfoKeyA
RegOpenKeyA
RegEnumKeyExA
RegEnumKeyA
RegConnectRegistryW
RegConnectRegistryA
LookupPrivilegeValueA
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
DeleteService
QueryServiceStatus
ControlService
OpenSCManagerW
RegGetValueW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteValueW
CryptEnumProvidersW
CryptDestroyHash

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CoGetApartmentType
CoTaskMemFree
CoGetObjectContext

oleaut32

VariantClear
SysFreeString
SysAllocString

odbc32

ord63
ord12
ord72
ord39
ord219
ord111
ord16
ord20
ord61
ord236
ord24
ord75
ord31
ord241
ord9
ord26
ord18
ord27
ord4
ord13
ord43

crypt32

CryptProtectData
CryptStringToBinaryW
CryptUnprotectData
CertFindCertificateInStore
CryptBinaryToStringW

userenv

GetAllUsersProfileDirectoryW

netapi32

NetSessionEnum

Exports

Exports

agtDefCreateCertAuthFile
agtDefPrepareEiAgentExeForRemoval
agtDefRegisterCanaryFiles
agtDefRemoveConfiguration
agtDefRemoveProgramData
agtDefRestoreFromBackupOfCertAuth
agtDefRestoreFromBackupOfPfxCert
agtDefSaveAgentSettings
agtDefSaveCertAuthToAppDir
agtDefUnregisterAndCleanupCanaryFiles
agtDefUnregisterEiConnectorProxy
agtImmActivateLicense
agtImmCopyCertAuthToTemp
agtImmDoesPrivilegedUserModify
agtImmEnsurePathsHaveBackslashAtEnd
agtImmEnsureSelfDefenseIsDisabled
agtImmImportAgentSettings
agtImmMakeBackupOfCertAuth
agtImmMakeBackupOfPfxCert
agtImmPreparePropertiesForDeferredCA
agtImmSetInstallerProperties
agtImmSilentDownloadCertAuth
agtImmStopEiConnectorProxy
agtImmVerifyDependencies
agtImmVerifyInstallation
agtWizDownloadCertAuth
agtWizVerifyCertAuth
commDefRemoveTempFiles
commDefStoreMsiCopy
commImmPrepareTemporaryFiles
commImmShowBrowserToSelectFile
sigar_arp_list_destroy
sigar_arp_list_get
sigar_close
sigar_cpu_get
sigar_cpu_info_list_destroy
sigar_cpu_info_list_get
sigar_cpu_list_destroy
sigar_cpu_list_get
sigar_cpu_perc_calculate
sigar_disk_usage_get
sigar_dump_pid_cache_get
sigar_file_system_list_destroy
sigar_file_system_list_get
sigar_file_system_ping
sigar_file_system_usage_get
sigar_format_size
sigar_fqdn_get
sigar_loadavg_get
sigar_log
sigar_log_impl_file
sigar_log_impl_set
sigar_log_level_get
sigar_log_level_set
sigar_log_level_string_get
sigar_log_printf
sigar_mem_get
sigar_net_address_equals
sigar_net_address_hash
sigar_net_address_to_string
sigar_net_connection_list_destroy
sigar_net_connection_list_get
sigar_net_connection_state_get
sigar_net_connection_type_get
sigar_net_connection_walk
sigar_net_info_get
sigar_net_interface_config_get
sigar_net_interface_config_primary_get
sigar_net_interface_flags_to_string
sigar_net_interface_list_destroy
sigar_net_interface_list_get
sigar_net_interface_stat_get
sigar_net_listen_address_get
sigar_net_route_list_destroy
sigar_net_route_list_get
sigar_net_scope_to_string
sigar_net_services_name_get
sigar_net_stat_get
sigar_net_stat_port_get
sigar_new
sigar_nfs_client_v2_get
sigar_nfs_client_v3_get
sigar_nfs_server_v2_get
sigar_nfs_server_v3_get
sigar_open
sigar_password_get
sigar_pid_get
sigar_proc_args_destroy
sigar_proc_args_get
sigar_proc_cpu_get
sigar_proc_cred_get
sigar_proc_cred_name_get
sigar_proc_cumulative_disk_io_get
sigar_proc_disk_io_get
sigar_proc_env_get
sigar_proc_exe_get
sigar_proc_fd_get
sigar_proc_list_destroy
sigar_proc_list_get
sigar_proc_mem_get
sigar_proc_modules_get
sigar_proc_port_get
sigar_proc_stat_get
sigar_proc_state_get
sigar_proc_time_get
sigar_resource_limit_get
sigar_strerror
sigar_swap_get
sigar_sys_info_get
sigar_tcp_get
sigar_thread_cpu_get
sigar_uptime_get
sigar_uptime_string
sigar_who_list_destroy
sigar_who_list_get
svrDefDeleteDatabase
svrDefInstallDatabase
svrDefRemoveConfiguration
svrDefRemoveProgramData
svrDefSaveCertificatesToAppDir
svrDefSaveServerSettings
svrImmCopyCertificatesToTemp
svrImmCopyEsmcCaToTemp
svrImmCopyServerPolicyToTemp
svrImmImportServerSettings
svrImmImportSettingsFromDatabase
svrImmPreparePropertiesForDeferredCA
svrImmSetDefaultParametersForClient
svrImmSilentDatabaseSettingsCheck
svrImmVerifyCertificatesForAgent
svrImmVerifyCertificatesForWeb
svrImmVerifyIfAppDbIsDeletable
svrImmVerifyInstallation
svrImmVerifyWindowsVersion
svrWizGenerateCertificateInEra
svrWizObtainEraCertAuth
svrWizObtainListOfCertificatesInEra
svrWizObtainServerCertificate
svrWizObtainWebCertificate
svrWizOnCertAuthChoosen
svrWizVerifyCertSettings1stPage
svrWizVerifyCertificatesForAgent
svrWizVerifyCertificatesForWeb
svrWizVerifyDatabaseSettings
svrWizVerifyEraConnection
svrWizVerifyServerPorts

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14.1MB - Virtual size: 14.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 393KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85d779e5615d599529f7e930def76fe9

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

user32

ws2_32

comdlg32

advapi32

shell32

ole32

oleaut32

odbc32

crypt32

userenv

netapi32

Exports

Exports

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 14.1MB - Virtual size: 14.1MB

.data Size: 393KB - Virtual size: 437KB

.pdata Size: 221KB - Virtual size: 221KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 96KB - Virtual size: 95KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 14.1MB - Virtual size: 14.1MB

.data
Size: 393KB - Virtual size: 437KB

.pdata
Size: 221KB - Virtual size: 221KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 96KB - Virtual size: 95KB