dll[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dll.dll
Size

2.1MB
MD5

66306cf3b4c6421ec2abe5f1747b1749
SHA1

407073f1c13f368da36821bd5ff98d5e7a174bbe
SHA256

c22991e7209f1bec796ee8e74b2075721b207c3c25633e61f4f403a301197d0a
SHA512

261ddf73b32e0babe2f26bcc26eec18613536bd1ab6a1459568c6818c0e924e59bff6e3fbc5acb0daa9a084f32d953ee3b36fce4126fea5500cfea4573b674c5
SSDEEP

49152:l+N0Ervgpn9Tp6bqHhebs9djWDcuwidUUPw+y/rg081Ifd1kwUzOkVa/R0wEZV+z:l+sTp6bqHhebs9djWDcuwidUUPw+y/rz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dll.dll

Files

dll.dll
.dll windows:6 windows x64

19c89ac3688e8abbde234ecdc40350a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WritePrivateProfileStringA
CreateThread
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
VirtualProtectEx
HeapDestroy
Beep
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
WideCharToMultiByte
CreateDirectoryA
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
CloseHandle
GetThreadContext
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
FindFirstFileExW
HeapReAlloc
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
LockResource
GetLastError
MultiByteToWideChar
HeapSize
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
OutputDebugStringW
CreateFileA
GetFileSizeEx
ReadFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleA
InitializeCriticalSectionEx
RaiseException
HeapFree
SizeofResource
FindFirstFileW
FindNextFileW

user32

ScreenToClient
ClientToScreen
GetMessageExtraInfo
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
GetKeyState
GetAsyncKeyState
GetCursorPos
EnumWindows
GetSystemMetrics
SetWindowLongPtrW
IsWindowUnicode
ReleaseCapture
SetCursorPos
CallWindowProcW
GetWindowThreadProcessId
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCapture

msvcp140

?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winmm

PlaySoundA
PlaySoundW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

imm32

ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140

strstr
__C_specific_handler
__intrinsic_setjmp
__std_exception_copy
memchr
memcpy
longjmp
strrchr
memcmp
_CxxThrowException
memmove
__std_type_info_destroy_list
memset
__std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fwrite
__stdio_common_vsscanf
_wfopen
fflush
__stdio_common_vfprintf
fseek
__acrt_iob_func
ftell
__stdio_common_vsprintf_s
fclose
__stdio_common_vsprintf
fread

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_errno
terminate
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_invalid_parameter_noinfo

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

atof
atoi
strtol

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
strncpy

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

fmodf
cos
atan2f
atan2
powf
acosf
asinf

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 521KB - Virtual size: 526KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19c89ac3688e8abbde234ecdc40350a4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

d3dx11_43

winmm

ntdll

imm32

d3dcompiler_43

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

vcruntime140_1

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.data Size: 521KB - Virtual size: 526KB

.idata Size: 7KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 521KB - Virtual size: 526KB

.idata
Size: 7KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB