libewf-2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libewf-2.dll
Size

7.1MB
MD5

0465f5fc99cff0ed225aae07478334ae
SHA1

88169ff7c2685a069c6c2f602711236f0f60ad89
SHA256

d8b62249d48ba411f3b3d0237dc91c5f5ac1c2fd4fc49325f2f4ef14493fcca3
SHA512

df40cb4a3c80d89480321838cda9e5a3a9520067568af5fbadb0fb5b6ab493e066b5f6706cda8716ae4086e78fbf6d7a7ad1ae882bd35a9c9a639ebe6631be5c
SSDEEP

98304:PTa5qbD8XrEPUQJhHSx5kf6DvT0nivkJI3xazrFreuJZY6p1Un1+MFdBqEw9SIPC:7QqbD8X3Q5jf2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libewf-2.dll

Files

libewf-2.dll
.dll windows:4 windows x64 arch:x64

720ce77b6041bfbff1722e528a5be33c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteCriticalSection
DeviceIoControl
DisableThreadLibraryCalls
EnterCriticalSection
FormatMessageA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileAttributesW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoA
GetOverlappedResult
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEndOfFile
SetFilePointerEx
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WriteFile

msvcrt

__dllonexit
__iob_func
_amsg_exit
_errno
_fileno
_fstat64
_initterm
_localtime64
_lock
_mktime64
_onexit
_time64
_unlock
_vsnprintf
abort
calloc
clearerr
fclose
feof
fopen
fprintf
fread
free
fseek
ftell
fwrite
getenv
malloc
memchr
memcmp
memcpy
memset
realloc
setlocale
signal
strlen
strncmp
vfprintf
wcslen
_tzname
_wcsnicmp
_strnicmp

zlib1

adler32
compress2
compressBound
uncompress

Exports

Exports

libewf_check_file_signature
libewf_check_file_signature_file_io_handle
libewf_check_file_signature_wide
libewf_error_backtrace_fprint
libewf_error_backtrace_sprint
libewf_error_fprint
libewf_error_free
libewf_error_sprint
libewf_file_entry_free
libewf_file_entry_get_access_time
libewf_file_entry_get_amount_of_sub_file_entries
libewf_file_entry_get_creation_time
libewf_file_entry_get_duplicate_media_data_offset
libewf_file_entry_get_entry_modification_time
libewf_file_entry_get_flags
libewf_file_entry_get_media_data_offset
libewf_file_entry_get_media_data_size
libewf_file_entry_get_modification_time
libewf_file_entry_get_name
libewf_file_entry_get_name_size
libewf_file_entry_get_number_of_sub_file_entries
libewf_file_entry_get_offset
libewf_file_entry_get_size
libewf_file_entry_get_sub_file_entry
libewf_file_entry_get_sub_file_entry_by_utf16_name
libewf_file_entry_get_sub_file_entry_by_utf16_path
libewf_file_entry_get_sub_file_entry_by_utf8_name
libewf_file_entry_get_sub_file_entry_by_utf8_path
libewf_file_entry_get_type
libewf_file_entry_get_utf16_hash_value_md5
libewf_file_entry_get_utf16_hash_value_sha1
libewf_file_entry_get_utf16_name
libewf_file_entry_get_utf16_name_size
libewf_file_entry_get_utf8_hash_value_md5
libewf_file_entry_get_utf8_hash_value_sha1
libewf_file_entry_get_utf8_name
libewf_file_entry_get_utf8_name_size
libewf_file_entry_read_buffer
libewf_file_entry_read_random
libewf_file_entry_seek_offset
libewf_file_get_file_entry_by_utf16_path
libewf_file_get_file_entry_by_utf8_path
libewf_get_access_flags_read
libewf_get_access_flags_read_write
libewf_get_access_flags_write
libewf_get_access_flags_write_resume
libewf_get_codepage
libewf_get_flags_read
libewf_get_flags_read_write
libewf_get_flags_write
libewf_get_flags_write_resume
libewf_get_version
libewf_glob
libewf_glob_free
libewf_glob_wide
libewf_glob_wide_free
libewf_handle_add_acquiry_error
libewf_handle_add_crc_error
libewf_handle_add_session
libewf_handle_append_acquiry_error
libewf_handle_append_checksum_error
libewf_handle_append_session
libewf_handle_append_track
libewf_handle_clone
libewf_handle_close
libewf_handle_copy_header_values
libewf_handle_copy_media_values
libewf_handle_free
libewf_handle_get_acquiry_error
libewf_handle_get_amount_of_acquiry_errors
libewf_handle_get_amount_of_crc_errors
libewf_handle_get_amount_of_hash_values
libewf_handle_get_amount_of_header_values
libewf_handle_get_amount_of_sectors
libewf_handle_get_amount_of_sessions
libewf_handle_get_bytes_per_sector
libewf_handle_get_checksum_error
libewf_handle_get_chunk_size
libewf_handle_get_compression_values
libewf_handle_get_crc_error
libewf_handle_get_delta_segment_file_size
libewf_handle_get_delta_segment_filename
libewf_handle_get_delta_segment_filename_size
libewf_handle_get_delta_segment_filename_size_wide
libewf_handle_get_delta_segment_filename_wide
libewf_handle_get_error_granularity
libewf_handle_get_file_io_handle
libewf_handle_get_filename
libewf_handle_get_filename_size
libewf_handle_get_filename_size_wide
libewf_handle_get_filename_wide
libewf_handle_get_format
libewf_handle_get_hash_value
libewf_handle_get_hash_value_identifier
libewf_handle_get_hash_value_identifier_size
libewf_handle_get_hash_value_size
libewf_handle_get_header_codepage
libewf_handle_get_header_value
libewf_handle_get_header_value_identifier
libewf_handle_get_header_value_identifier_size
libewf_handle_get_header_value_size
libewf_handle_get_header_values_date_format
libewf_handle_get_maximum_delta_segment_size
libewf_handle_get_maximum_segment_size
libewf_handle_get_md5_hash
libewf_handle_get_media_flags
libewf_handle_get_media_size
libewf_handle_get_media_type
libewf_handle_get_number_of_acquiry_errors
libewf_handle_get_number_of_checksum_errors
libewf_handle_get_number_of_chunks_written
libewf_handle_get_number_of_crc_errors
libewf_handle_get_number_of_hash_values
libewf_handle_get_number_of_header_values
libewf_handle_get_number_of_sectors
libewf_handle_get_number_of_sessions
libewf_handle_get_number_of_tracks
libewf_handle_get_offset
libewf_handle_get_root_file_entry
libewf_handle_get_sectors_per_chunk
libewf_handle_get_segment_file_set_identifier
libewf_handle_get_segment_file_size
libewf_handle_get_segment_filename
libewf_handle_get_segment_filename_size
libewf_handle_get_segment_filename_size_wide
libewf_handle_get_segment_filename_wide
libewf_handle_get_session
libewf_handle_get_sha1_hash
libewf_handle_get_track
libewf_handle_get_utf16_hash_value
libewf_handle_get_utf16_hash_value_size
libewf_handle_get_utf16_header_value
libewf_handle_get_utf16_header_value_size
libewf_handle_get_utf8_hash_value
libewf_handle_get_utf8_hash_value_size
libewf_handle_get_utf8_header_value
libewf_handle_get_utf8_header_value_size
libewf_handle_get_write_amount_of_chunks
libewf_handle_initialize
libewf_handle_open
libewf_handle_open_file_io_pool
libewf_handle_open_wide
libewf_handle_prepare_read_chunk
libewf_handle_prepare_write_chunk
libewf_handle_read_buffer
libewf_handle_read_chunk
libewf_handle_read_random
libewf_handle_seek_offset
libewf_handle_segment_files_corrupted
libewf_handle_set_bytes_per_sector
libewf_handle_set_compression_values
libewf_handle_set_delta_segment_file_size
libewf_handle_set_delta_segment_filename
libewf_handle_set_delta_segment_filename_wide
libewf_handle_set_error_granularity
libewf_handle_set_format
libewf_handle_set_hash_value
libewf_handle_set_header_codepage
libewf_handle_set_header_value
libewf_handle_set_header_values_date_format
libewf_handle_set_maximum_amount_of_open_handles
libewf_handle_set_maximum_delta_segment_size
libewf_handle_set_maximum_number_of_open_handles
libewf_handle_set_maximum_segment_size
libewf_handle_set_md5_hash
libewf_handle_set_media_flags
libewf_handle_set_media_size
libewf_handle_set_media_type
libewf_handle_set_read_wipe_chunk_on_error
libewf_handle_set_read_zero_chunk_on_error
libewf_handle_set_sectors_per_chunk
libewf_handle_set_segment_file_set_identifier
libewf_handle_set_segment_file_size
libewf_handle_set_segment_filename
libewf_handle_set_segment_filename_wide
libewf_handle_set_sha1_hash
libewf_handle_set_utf16_hash_value
libewf_handle_set_utf16_header_value
libewf_handle_set_utf8_hash_value
libewf_handle_set_utf8_header_value
libewf_handle_signal_abort
libewf_handle_write_buffer
libewf_handle_write_chunk
libewf_handle_write_finalize
libewf_handle_write_random
libewf_notify_set_stream
libewf_notify_set_verbose
libewf_notify_stream_close
libewf_notify_stream_open
libewf_set_codepage

Sections

.text
Size: 654KB - Virtual size: 653KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 572KB - Virtual size: 571KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

720ce77b6041bfbff1722e528a5be33c

Headers

File Characteristics

Imports

kernel32

msvcrt

zlib1

Exports

Exports

Sections

.text Size: 654KB - Virtual size: 653KB

.data Size: 1024B - Virtual size: 560B

.rdata Size: 572KB - Virtual size: 571KB

.pdata Size: 16KB - Virtual size: 16KB

.xdata Size: 18KB - Virtual size: 18KB

.bss Size: - Virtual size: 2KB

.edata Size: 8KB - Virtual size: 8KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 596B

/4 Size: 7KB - Virtual size: 6KB

/19 Size: 3.9MB - Virtual size: 3.9MB

/31 Size: 87KB - Virtual size: 87KB

/45 Size: 217KB - Virtual size: 216KB

/57 Size: 98KB - Virtual size: 97KB

/70 Size: 64KB - Virtual size: 64KB

/81 Size: 1.2MB - Virtual size: 1.2MB

/92 Size: 6KB - Virtual size: 5KB

.text
Size: 654KB - Virtual size: 653KB

.data
Size: 1024B - Virtual size: 560B

.rdata
Size: 572KB - Virtual size: 571KB

.pdata
Size: 16KB - Virtual size: 16KB

.xdata
Size: 18KB - Virtual size: 18KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 8KB - Virtual size: 8KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 596B

/4
Size: 7KB - Virtual size: 6KB

/19
Size: 3.9MB - Virtual size: 3.9MB

/31
Size: 87KB - Virtual size: 87KB

/45
Size: 217KB - Virtual size: 216KB

/57
Size: 98KB - Virtual size: 97KB

/70
Size: 64KB - Virtual size: 64KB

/81
Size: 1.2MB - Virtual size: 1.2MB

/92
Size: 6KB - Virtual size: 5KB