libOni[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

libOni.dll
Size

985KB
MD5

273449d438314b5802aa69ef3f42c754
SHA1

ec768cb1159db2a12bcfacbaaf6eddbe9ec8bbfc
SHA256

2b2c987cd387087fa6d1edef2143eb2090f6715fcf491b6598c40e5f8efa358d
SHA512

ca9c2ec2110f906652e5dab5a3cb6c4e99e680040ff0f56fff60363ef9f3d47718580b54b98bdb775fc9dd5bcb5be82c9c2470d39c3ca2d61bf9a8952e1981c3
SSDEEP

24576:8UkjKo0cLsdue2qJC9e2uTZ+2pNjoqfqLqgqQzDzM:8UkjKo04sduoMjuTZLpNjoqfqLqgqQzE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libOni.dll

Files

libOni.dll
.dll windows:6 windows x64

20120285df85e1732a768087f196f4f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ChangeTimerQueueTimer
CloseHandle
CreateEventW
CreateFileW
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
DecodePointer
DeleteCriticalSection
DeleteTimerQueueTimer
DuplicateHandle
EncodePointer
EnterCriticalSection
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetExitCodeThread
GetFileType
GetLastError
GetLogicalProcessorInformation
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetNumaHighestNodeNumber
GetOEMCP
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetThreadPriority
GetThreadTimes
GetTickCount
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
QueryDepthSList
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RegisterWaitForSingleObject
ReleaseSemaphore
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetThreadAffinityMask
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnregisterWait
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

Exports

Exports

AddBatch
AddChild
ApplyFrame
ApplyPositionInterpolation
BeginSample
BendingConstraintRest
Bind
CalculatePrimitiveCounts
CalculateRestShapeMatching
ClearProfiler
CollisionDetection
Complete
CompleteAll
ContinueBuildingDistanceField
CreateBatch
CreateCollisionMaterial
CreateDistanceField
CreateEmpty
CreateHalfEdgeMesh
CreateSolver
CreateTriangleSkinMap
DestroyBatch
DestroyCollisionMaterial
DestroyDistanceField
DestroyHalfEdgeMesh
DestroySolver
DestroyTriangleSkinMap
EnableBatch
EnableProfiler
EndSample
Generate
GetBatchConstraintCount
GetBatchConstraintForces
GetBounds
GetCollisionContacts
GetConstraintCount
GetConstraintGroupParameters
GetDeformableTriangleCount
GetDistanceFieldNodeCount
GetDistanceFieldNodes
GetFaceCount
GetFlagsFromPhase
GetGroupFromPhase
GetHalfEdgeCount
GetHalfEdgeMeshInfo
GetMaxSystemConcurrency
GetParticleCollisionContacts
GetParticleGrid
GetParticleGridSize
GetPointCloudAnisotropy
GetProfilingInfo
GetProfilingInfoCount
GetQueryResults
GetSkinInfo
GetSkinnedVertexCount
GetSolverParameters
GetVertexCount
InitializeFrame
InterpolateDiffuseParticles
MakePhase
RecalculateInertiaTensors
RemoveBatch
RemoveDeformableTriangles
ResetForces
SampleDistanceField
Schedule
SetActiveParticles
SetAerodynamicConstraints
SetBatchConstraintCount
SetBendTwistConstraints
SetBendingConstraints
SetCapacity
SetChainConstraints
SetColliders
SetCollisionMaterials
SetConstraintGroupParameters
SetDeformableTriangles
SetDistanceConstraints
SetDistanceFieldData
SetDistanceFieldNodes
SetEdgeMeshData
SetFaces
SetHalfEdges
SetHeightFieldData
SetInverseOrientations
SetNormals
SetParticleAngularVelocities
SetParticleAnisotropies
SetParticleAtmosphericDragPressure
SetParticleBuoyancy
SetParticleCollisionMaterials
SetParticleDiffusion
SetParticleExternalForces
SetParticleExternalTorques
SetParticleFilters
SetParticleFluidData
SetParticleInverseInertiaTensors
SetParticleInverseMasses
SetParticleInverseRotationalMasses
SetParticleNormals
SetParticleOrientationConstraintCounts
SetParticleOrientationDeltas
SetParticleOrientations
SetParticlePhases
SetParticlePositionConstraintCounts
SetParticlePositionDeltas
SetParticlePositions
SetParticlePreviousOrientations
SetParticlePreviousPositions
SetParticlePrincipalRadii
SetParticleRestDensities
SetParticleSmoothingRadii
SetParticleSurfaceTension
SetParticleUserData
SetParticleVelocities
SetParticleViscosities
SetParticleVorticities
SetParticleVorticityConfinement
SetParticleWinds
SetPinConstraints
SetRenderableParticleOrientations
SetRenderableParticlePositions
SetRestOrientations
SetRestPositions
SetRigidbodies
SetRigidbodyAngularDeltas
SetRigidbodyLinearDeltas
SetShapeMatchingConstraints
SetSimplices
SetSkinConstraints
SetSkinInfo
SetSolverParameters
SetStitchConstraints
SetStretchShearConstraints
SetTangents
SetTetherConstraints
SetTriangleMeshData
SetVertices
SetVisualMap
SetVolumeConstraints
SpatialQuery
StartBuildingDistanceField
Step
UpdateColliderGrid
UpdateCollisionMaterial
UpdateFrame
UpdateSkeletalAnimation

Sections

.text
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20120285df85e1732a768087f196f4f2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 717KB - Virtual size: 717KB

.rdata Size: 181KB - Virtual size: 181KB

.data Size: 44KB - Virtual size: 52KB

.pdata Size: 30KB - Virtual size: 29KB

.00cfg Size: 512B - Virtual size: 16B

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 424B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 717KB - Virtual size: 717KB

.rdata
Size: 181KB - Virtual size: 181KB

.data
Size: 44KB - Virtual size: 52KB

.pdata
Size: 30KB - Virtual size: 29KB

.00cfg
Size: 512B - Virtual size: 16B

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 424B

.reloc
Size: 6KB - Virtual size: 5KB