libpcre2-16-0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
libpcre2-16-0.dll
Size 528KB
Sample231116-113bvsha34
SHA256 eda251aee8ec7f841baae1fe98c40ccf2d7a007e6f0b34fc8300f9c7fc3502b8
MD5 89d69d1f874e768049386000525b3a65
SHA1 e2d93894cbb275a856f62c04b883b94f987cd086
SHA512 e698ad57aa04e37d1bdf1018f10252ce82c1a1fc8c293fb96bc1d0536e70d3e4c986bcd1d365740862cccac55b0f2d86bd20f240a3e4e6e74bce742358e3220f
SSDEEP 12288:EvVOXjzCt9CcbgC03OVszMq7zDSWrJ6ha/eFUoh:EvVOXjzCt9C40+yIq7vSGYha/eFUoh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libpcre2-16-0.dll

File Explorer

libpcre2-16-0.dll

.dll 528KB

libpcre2-16-0.dll

IMPHASH 9adbea889378741529c65bd278a8a3d9
SHA256 eda251aee8ec7f841baae1fe98c40ccf2d7a007e6f0b34fc8300f9c7fc3502b8
MD5 89d69d1f874e768049386000525b3a65
SHA1 e2d93894cbb275a856f62c04b883b94f987cd086
SHA512 e698ad57aa04e37d1bdf1018f10252ce82c1a1fc8c293fb96bc1d0536e70d3e4c986bcd1d365740862cccac55b0f2d86bd20f240a3e4e6e74bce742358e3220f
SSDEEP 12288:EvVOXjzCt9CcbgC03OVszMq7zDSWrJ6ha/eFUoh:EvVOXjzCt9C40+yIq7vSGYha/eFUoh
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

_pcre2_OP_lengths_16 _pcre2_auto_possessify_16 _pcre2_callout_end_delims_16 _pcre2_callout_start_delims_16 _pcre2_check_escape_16 _pcre2_default_compile_context_16 _pcre2_default_convert_context_16 _pcre2_default_match_context_16 _pcre2_default_tables_16 _pcre2_extuni_16 _pcre2_find_bracket_16 _pcre2_hspace_list_16 _pcre2_is_newline_16 _pcre2_jit_free_16 _pcre2_jit_free_rodata_16 _pcre2_jit_get_size_16 _pcre2_jit_get_target_16 _pcre2_memctl_malloc_16 _pcre2_ord2utf_16 _pcre2_script_run_16 _pcre2_strcmp_16 _pcre2_strcmp_c8_16 _pcre2_strcpy_c8_16 _pcre2_strlen_16 _pcre2_strncmp_16 _pcre2_strncmp_c8_16 _pcre2_study_16 _pcre2_ucd_caseless_sets_16 _pcre2_ucd_digit_sets_16 _pcre2_ucd_records_16 _pcre2_ucd_script_sets_16 _pcre2_ucd_stage1_16 _pcre2_ucd_stage2_16 _pcre2_ucp_gbtable_16 _pcre2_ucp_gentype_16 _pcre2_ucp_typerange_16 _pcre2_unicode_version_16 _pcre2_utt_16 _pcre2_utt_names_16 _pcre2_utt_size_16 _pcre2_valid_utf_16 _pcre2_vspace_list_16 _pcre2_was_newline_16 _pcre2_xclass_16 pcre2_callout_enumerate_16 pcre2_code_copy_16 pcre2_code_copy_with_tables_16 pcre2_code_free_16 pcre2_compile_16 pcre2_compile_context_copy_16 pcre2_compile_context_create_16 pcre2_compile_context_free_16 pcre2_config_16 pcre2_convert_context_copy_16 pcre2_convert_context_create_16 pcre2_convert_context_free_16 pcre2_converted_pattern_free_16 pcre2_dfa_match_16 pcre2_general_context_copy_16 pcre2_general_context_create_16 pcre2_general_context_free_16 pcre2_get_error_message_16 pcre2_get_mark_16 pcre2_get_ovector_count_16 pcre2_get_ovector_pointer_16 pcre2_get_startchar_16 pcre2_jit_compile_16 pcre2_jit_free_unused_memory_16 pcre2_jit_match_16 pcre2_jit_stack_assign_16 pcre2_jit_stack_create_16 pcre2_jit_stack_free_16 pcre2_maketables_16 pcre2_match_16 pcre2_match_context_copy_16 pcre2_match_context_create_16 pcre2_match_context_free_16 pcre2_match_data_create_16 pcre2_match_data_create_from_pattern_16 pcre2_match_data_free_16 pcre2_pattern_convert_16 pcre2_pattern_info_16 pcre2_serialize_decode_16 pcre2_serialize_encode_16 pcre2_serialize_free_16 pcre2_serialize_get_number_of_codes_16 pcre2_set_bsr_16 pcre2_set_callout_16 pcre2_set_character_tables_16 pcre2_set_compile_extra_options_16 pcre2_set_compile_recursion_guard_16 pcre2_set_depth_limit_16 pcre2_set_glob_escape_16 pcre2_set_glob_separator_16 pcre2_set_heap_limit_16 pcre2_set_match_limit_16 pcre2_set_max_pattern_length_16 pcre2_set_newline_16 pcre2_set_offset_limit_16 pcre2_set_parens_nest_limit_16 pcre2_set_recursion_limit_16 pcre2_set_recursion_memory_management_16 pcre2_set_substitute_callout_16 pcre2_substitute_16 pcre2_substring_copy_byname_16 pcre2_substring_copy_bynumber_16 pcre2_substring_free_16 pcre2_substring_get_byname_16 pcre2_substring_get_bynumber_16 pcre2_substring_length_byname_16 pcre2_substring_length_bynumber_16 pcre2_substring_list_free_16 pcre2_substring_list_get_16 pcre2_substring_nametable_scan_16 pcre2_substring_number_from_name_16

Name

.text

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libpcre2-16-0.dll

kernel32

msvcrt

generic