AtlasInternal[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AtlasInternal.dll
Size

730KB
MD5

b21837e150dc779751dbeb622f06cc5a
SHA1

1d7b065766e24edb725de260509c96d8a425468b
SHA256

3ea2fe228a108bee101c639646c92654d51008ba71e62b417301268428cdfbe2
SHA512

b0559162c7dbce3a517fd13f804c0e6ef227a9e6ced4da84977be0d83c8be479d2b4103921670ec52756205476005040b9621ab9751cc75268b6b29c1c509ed1
SSDEEP

12288:MFyyH8YZG5HS8amoBV/tjmujXDxlSQ5EDJzC6ugW6+Y37zgeUj:nyHlZay44ljjT+XD1zW6H3AeUj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AtlasInternal.dll

Files

AtlasInternal.dll
.dll windows:6 windows x86

be152c140d325a66af7437322e166aa1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AddVectoredExceptionHandler
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleFileNameA
GetLastError
FormatMessageA
SuspendThread
ResumeThread
CloseHandle
GetSystemInfo
CreateThread
GetThreadContext
FreeConsole
AllocConsole
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InitOnceBeginInitialize
InitOnceComplete
GetCurrentProcess
GetConsoleWindow
VirtualQuery
GetProcAddress
SetConsoleTitleA
VirtualProtect
Sleep
SetThreadContext
GetModuleHandleA

user32

CloseClipboard
OpenClipboard
TrackMouseEvent
IsChild
LoadCursorW
EmptyClipboard
GetClipboardData
ClientToScreen
SetCapture
SetCursor
GetClientRect
SetClipboardData
GetCapture
ReleaseCapture
SetCursorPos
CallWindowProcW
SetWindowLongA
FindWindowA
MessageBoxA
PostMessageW
ScreenToClient
GetAsyncKeyState
GetForegroundWindow
GetCursorPos
SendInput

msvcp140

?always_noconv@codecvt_base@std@@QBE_NXZ
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Xbad_alloc@std@@YAXXZ
_Strxfrm
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Xtime_get_ticks
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

vcruntime140

__std_type_info_destroy_list
memset
_except_handler4_common
_CxxThrowException
__current_exception_context
__current_exception
_setjmp3
memchr
strrchr
longjmp
strchr
memcpy
strstr
memmove
__std_terminate
__std_exception_copy
__CxxFrameHandler3
__std_exception_destroy

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort

api-ms-win-crt-runtime-l1-1-0

abort
_errno
strerror
system
terminate
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
exit

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers
fseek
fsetpos
fgetpos
fclose
fflush
fgetc
fputc
ungetc
__stdio_common_vfprintf
getc
fopen
ferror
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
feof
_wfopen
ftell
fputs
freopen
tmpnam
fgets
__acrt_iob_func
_fseeki64
clearerr
_popen
__stdio_common_vfscanf
setvbuf
tmpfile
_pclose
fwrite

api-ms-win-crt-math-l1-1-0

_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_CIfmod
_dsign
_CIcosh
_libm_sse2_acos_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_CIatan2
_libm_sse2_sin_precise
modf
_dclass
ldexp
frexp
_libm_sse2_sqrt_precise
_libm_sse2_log10_precise
_CItanh
_libm_sse2_exp_precise
_libm_sse2_tan_precise
ceil
floor
_CIsinh

api-ms-win-crt-convert-l1-1-0

atof
strtoul
strtoull
strtod
strtoll

api-ms-win-crt-locale-l1-1-0

localeconv
setlocale

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_callnewh

api-ms-win-crt-string-l1-1-0

strcspn
strncat
isdigit
iscntrl
strcoll
islower
ispunct
isxdigit
tolower
isspace
isblank
isalnum
isupper
strpbrk
toupper
strncpy
isalpha

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_difftime64
clock
_mktime64
_localtime64
_time64
strftime
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

remove
_unlock_file
rename
_lock_file

Sections

.text
Size: 564KB - Virtual size: 563KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be152c140d325a66af7437322e166aa1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

d3d11

d3dcompiler_47

imm32

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Sections

.text Size: 564KB - Virtual size: 563KB

.rdata Size: 135KB - Virtual size: 134KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 564KB - Virtual size: 563KB

.rdata
Size: 135KB - Virtual size: 134KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 24KB - Virtual size: 23KB