hyByFaker[.]dll

General

Target

hyByFaker.dll
Size

28KB
MD5

400b10b7c1c229162b7c200f86b8e8e3
SHA1

c39e145d38b29a0f68155b1a764ce5cd162a6b59
SHA256

1b2eee582e94e12c9637ae73f30f8eeb16812463b03c20a00544a9047658e4f2
SHA512

d714c86fdcb1898f967f5f81c5b67bf78cc2ba8c0033362f94c87ea62f6de7e72a6a2ad1b53628efd48b1c54a208dcf0abccc77b5285af27bc4ab97cac20826e
SSDEEP

384:NQS9ekZtDLGGBYjWzq7SURYTim1S6q/Hming4SH31KsP9eAYCM9/EevY3D:TbtuGRzoYPWZn/i9YzvY3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hyByFaker.dll

Files

hyByFaker.dll
.dll windows x86

a3e53f6b55e7afeee881b963838ad4fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFreeEx
GetExitCodeProcess
Process32First
CreateRemoteThread
CreateToolhelp32Snapshot
Process32Next
SetUnhandledExceptionFilter
ReadProcessMemory
VirtualAllocEx
GetProcAddress
VirtualProtectEx
CloseHandle
LoadLibraryA
Sleep
OpenProcess
WriteProcessMemory
GetCurrentProcess
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

memset
__std_type_info_destroy_list
_except_handler4_common
__std_exception_copy
__std_exception_destroy
memcpy
_CxxThrowException
memmove

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

_stricmp

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3e53f6b55e7afeee881b963838ad4fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 15KB - Virtual size: 15KB

.reloc Size: 1024B - Virtual size: 632B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 15KB - Virtual size: 15KB

.reloc
Size: 1024B - Virtual size: 632B