mkpub_nghttp2[.]dll

Resubmissions

03/10/2023, 10:11

231003-l8ehfabf64 3

03/10/2023, 09:41

231003-lnw7rahf7s 5

03/10/2023, 09:29

231003-lf792sbe63 5

Sharing

Copy URL Twitter E-mail

General

Target

mkpub_nghttp2.dll
Size

154KB
MD5

77cbf057a3df3de45b2eb76a0b8b021b
SHA1

22c3f9bdbc10216bd122bc4b8ed6a83f9cc71ade
SHA256

13ba60bb66aca14222ab7ff831ac6c0ccc59007fb43f962c32d9702743c4a083
SHA512

8756ec405b1f9bfe2ecbf4a746a477dc2fbcd3178bccde0d3d842256684bc6d6e848a9d4b139b95ce1a7ee0e84762de38be9fc43ebef13a3b8d5f9c1bf7dd577
SSDEEP

3072:Icr/FofJswK3occQ6FoqvjGMWtYdVU1WgKIKaqwHRULkolQf:N/FWBK3WVU1WgKIKaqwD0Qf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mkpub_nghttp2.dll

Files

mkpub_nghttp2.dll
.dll windows:6 windows x64

Password: infected

683d6b7c69e8049760f0793cb7a1e1a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
RtlCaptureContext

Exports

Exports

tghttp2_check_header_name
tghttp2_check_header_value
tghttp2_hd_deflate_bound
tghttp2_hd_deflate_change_table_size
tghttp2_hd_deflate_del
tghttp2_hd_deflate_get_dynamic_table_size
tghttp2_hd_deflate_get_max_dynamic_table_size
tghttp2_hd_deflate_get_num_table_entries
tghttp2_hd_deflate_get_table_entry
tghttp2_hd_deflate_hd
tghttp2_hd_deflate_hd_vec
tghttp2_hd_deflate_new
tghttp2_hd_deflate_new2
tghttp2_hd_inflate_change_table_size
tghttp2_hd_inflate_del
tghttp2_hd_inflate_end_headers
tghttp2_hd_inflate_get_dynamic_table_size
tghttp2_hd_inflate_get_max_dynamic_table_size
tghttp2_hd_inflate_get_num_table_entries
tghttp2_hd_inflate_get_table_entry
tghttp2_hd_inflate_hd
tghttp2_hd_inflate_hd2
tghttp2_hd_inflate_new
tghttp2_hd_inflate_new2
tghttp2_http2_strerror
tghttp2_is_fatal
tghttp2_nv_compare_name
tghttp2_option_del
tghttp2_option_new
tghttp2_option_set_builtin_recv_extension_type
tghttp2_option_set_max_deflate_dynamic_table_size
tghttp2_option_set_max_reserved_remote_streams
tghttp2_option_set_max_send_header_block_length
tghttp2_option_set_no_auto_ping_ack
tghttp2_option_set_no_auto_window_update
tghttp2_option_set_no_closed_streams
tghttp2_option_set_no_http_messaging
tghttp2_option_set_no_recv_client_magic
tghttp2_option_set_peer_max_concurrent_streams
tghttp2_option_set_user_recv_extension_type
tghttp2_pack_settings_payload
tghttp2_priority_spec_check_default
tghttp2_priority_spec_default_init
tghttp2_priority_spec_init
tghttp2_rcbuf_decref
tghttp2_rcbuf_get_buf
tghttp2_rcbuf_incref
tghttp2_rcbuf_is_static
tghttp2_select_next_protocol
tghttp2_session_callbacks_del
tghttp2_session_callbacks_new
tghttp2_session_callbacks_set_before_frame_send_callback
tghttp2_session_callbacks_set_data_source_read_length_callback
tghttp2_session_callbacks_set_error_callback
tghttp2_session_callbacks_set_error_callback2
tghttp2_session_callbacks_set_on_begin_frame_callback
tghttp2_session_callbacks_set_on_begin_headers_callback
tghttp2_session_callbacks_set_on_data_chunk_recv_callback
tghttp2_session_callbacks_set_on_extension_chunk_recv_callback
tghttp2_session_callbacks_set_on_frame_not_send_callback
tghttp2_session_callbacks_set_on_frame_recv_callback
tghttp2_session_callbacks_set_on_frame_send_callback
tghttp2_session_callbacks_set_on_header_callback
tghttp2_session_callbacks_set_on_header_callback2
tghttp2_session_callbacks_set_on_invalid_frame_recv_callback
tghttp2_session_callbacks_set_on_invalid_header_callback
tghttp2_session_callbacks_set_on_invalid_header_callback2
tghttp2_session_callbacks_set_on_stream_close_callback
tghttp2_session_callbacks_set_pack_extension_callback
tghttp2_session_callbacks_set_recv_callback
tghttp2_session_callbacks_set_select_padding_callback
tghttp2_session_callbacks_set_send_callback
tghttp2_session_callbacks_set_send_data_callback
tghttp2_session_callbacks_set_unpack_extension_callback
tghttp2_session_change_stream_priority
tghttp2_session_check_request_allowed
tghttp2_session_check_server_session
tghttp2_session_client_new
tghttp2_session_client_new2
tghttp2_session_client_new3
tghttp2_session_consume
tghttp2_session_consume_connection
tghttp2_session_consume_stream
tghttp2_session_create_idle_stream
tghttp2_session_del
tghttp2_session_find_stream
tghttp2_session_get_effective_local_window_size
tghttp2_session_get_effective_recv_data_length
tghttp2_session_get_hd_deflate_dynamic_table_size
tghttp2_session_get_hd_inflate_dynamic_table_size
tghttp2_session_get_last_proc_stream_id
tghttp2_session_get_local_settings
tghttp2_session_get_local_window_size
tghttp2_session_get_next_stream_id
tghttp2_session_get_outbound_queue_size
tghttp2_session_get_remote_settings
tghttp2_session_get_remote_window_size
tghttp2_session_get_root_stream
tghttp2_session_get_stream_effective_local_window_size
tghttp2_session_get_stream_effective_recv_data_length
tghttp2_session_get_stream_local_close
tghttp2_session_get_stream_local_window_size
tghttp2_session_get_stream_remote_close
tghttp2_session_get_stream_remote_window_size
tghttp2_session_get_stream_user_data
tghttp2_session_mem_recv
tghttp2_session_mem_send
tghttp2_session_recv
tghttp2_session_resume_data
tghttp2_session_send
tghttp2_session_server_new
tghttp2_session_server_new2
tghttp2_session_server_new3
tghttp2_session_set_local_window_size
tghttp2_session_set_next_stream_id
tghttp2_session_set_stream_user_data
tghttp2_session_set_user_data
tghttp2_session_terminate_session
tghttp2_session_terminate_session2
tghttp2_session_upgrade
tghttp2_session_upgrade2
tghttp2_session_want_read
tghttp2_session_want_write
tghttp2_set_debug_vprintf_callback
tghttp2_stream_get_first_child
tghttp2_stream_get_next_sibling
tghttp2_stream_get_parent
tghttp2_stream_get_previous_sibling
tghttp2_stream_get_state
tghttp2_stream_get_stream_id
tghttp2_stream_get_sum_dependency_weight
tghttp2_stream_get_weight
tghttp2_strerror
tghttp2_submit_altsvc
tghttp2_submit_data
tghttp2_submit_extension
tghttp2_submit_goaway
tghttp2_submit_headers
tghttp2_submit_origin
tghttp2_submit_ping
tghttp2_submit_priority
tghttp2_submit_push_promise
tghttp2_submit_request
tghttp2_submit_response
tghttp2_submit_rst_stream
tghttp2_submit_settings
tghttp2_submit_shutdown_notice
tghttp2_submit_trailer
tghttp2_submit_window_update
vcab

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

683d6b7c69e8049760f0793cb7a1e1a3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 5KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 5KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB