0d6d88bf631eee4f4ca0a33b232c00d0_dll64_JC[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

0d6d88bf631eee4f4ca0a33b232c00d0_dll64_JC.dll
Size

4.0MB
MD5

0d6d88bf631eee4f4ca0a33b232c00d0
SHA1

386b21899dfb5e600a0f3b8eac226dcb82bb135f
SHA256

3198973d4cb11712fcdcb1330483b62c1c5aa36e3e43e705c9a5a7d764dd8cee
SHA512

dcc1bbe7a0cf5f3ad06ed9f18aff3f3f2e09654f08163769e247f21bf141a42d881bb74d2e1f23aa4f8ae5bcc915cccf4a474167fe9a1833b9bd0daea5c591e7
SSDEEP

98304:iRo+WyQzLGqpad06FfJDhtdcPWjNFFrrmMRfVeTAJeWxYZg/X/8KQOF5IATaFCu6:j+ddPpiW9qMRq5D1+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d6d88bf631eee4f4ca0a33b232c00d0_dll64_JC.dll

Files

0d6d88bf631eee4f4ca0a33b232c00d0_dll64_JC.dll
.dll windows:6 windows x64

27c18ab5da498e0be55993e13e2dc802

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ReleaseMutex
ReleaseSRWLockShared
GetLastError
AcquireSRWLockExclusive
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetConsoleMode
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockShared
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
IsProcessorFeaturePresent

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

ntdll

NtWriteFile
RtlNtStatusToDosError

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
memmove
memset
memcmp
memcpy
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

trunc
floor
round

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_initterm_e
_seh_filter_dll
_initterm
_cexit

Exports

Exports

rakaly_ck3_file
rakaly_error_length
rakaly_error_write_data
rakaly_eu4_file
rakaly_file_error
rakaly_file_is_binary
rakaly_file_melt
rakaly_file_meta
rakaly_file_meta_melt
rakaly_file_value
rakaly_free_error
rakaly_free_file
rakaly_free_melt
rakaly_hoi4_file
rakaly_imperator_file
rakaly_melt_binary_unknown_tokens
rakaly_melt_data_length
rakaly_melt_error
rakaly_melt_is_verbatim
rakaly_melt_value
rakaly_melt_write_data
rakaly_vic3_file

Sections

.text
Size: 806KB - Virtual size: 806KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27c18ab5da498e0be55993e13e2dc802

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

bcrypt

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 806KB - Virtual size: 806KB

.rdata Size: 3.1MB - Virtual size: 3.1MB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 13KB - Virtual size: 12KB

.reloc Size: 106KB - Virtual size: 105KB

.text
Size: 806KB - Virtual size: 806KB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 13KB - Virtual size: 12KB

.reloc
Size: 106KB - Virtual size: 105KB