merlin | merlin[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

merlin.dll
Size

12.1MB
MD5

e7f3291205e582e03f42ff63f9f48843
SHA1

3148d161d6d4a611335b45eab27c73a7a8bf882f
SHA256

30d50a84fbb7fe1c25647eb70ee58cfda8be64ad1f8a094bd74e017fce596580
SHA512

380f2f2d041d34a71070a323fa7c682c6e6b63f9a3add14fc45049228cebed7e46968fc40ad4827f63a4f0af3cd4533e59dd233e8f9e34c4ff514d868a903e25
SSDEEP

98304:bak1WIaG9Iq4pjizSQFSRdAJzPaYimNab11QwGErh5ilfV7vvhtVpTo723YHjt6x:Lyq4pjizSXaJ2YO1Q0jU7vLt

Score

10^/10

merlin

Malware Config

Signatures

Merlin family
merlin

Merlin payload 1 IoCs

resource	yara_rule
sample	family_merlin

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
merlin.dll

Files

merlin.dll
.dll regsvr32 windows:4 windows x64 arch:x64

f797e2c7ee8726b15ff2ba13bf1f1b20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_beginthread
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
realloc
strerror
strlen
strncmp
vfprintf
wcslen

Exports

Exports

DllInstall
DllRegisterServer
DllUnregisterServer
Merlin
Run
VoidFunc
_cgo_dummy_export

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 427KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f797e2c7ee8726b15ff2ba13bf1f1b20

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 5.0MB - Virtual size: 5.0MB

.data Size: 537KB - Virtual size: 536KB

.rdata Size: 5.0MB - Virtual size: 5.0MB

.pdata Size: 113KB - Virtual size: 113KB

.xdata Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 427KB

.edata Size: 512B - Virtual size: 208B

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 96KB - Virtual size: 96KB

/4 Size: 1KB - Virtual size: 1KB

/19 Size: 240KB - Virtual size: 239KB

/31 Size: 15KB - Virtual size: 14KB

/45 Size: 30KB - Virtual size: 30KB

/57 Size: 7KB - Virtual size: 7KB

/70 Size: 2KB - Virtual size: 2KB

/81 Size: 69KB - Virtual size: 69KB

/92 Size: 4KB - Virtual size: 3KB

.text
Size: 5.0MB - Virtual size: 5.0MB

.data
Size: 537KB - Virtual size: 536KB

.rdata
Size: 5.0MB - Virtual size: 5.0MB

.pdata
Size: 113KB - Virtual size: 113KB

.xdata
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 427KB

.edata
Size: 512B - Virtual size: 208B

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 96KB - Virtual size: 96KB

/4
Size: 1KB - Virtual size: 1KB

/19
Size: 240KB - Virtual size: 239KB

/31
Size: 15KB - Virtual size: 14KB

/45
Size: 30KB - Virtual size: 30KB

/57
Size: 7KB - Virtual size: 7KB

/70
Size: 2KB - Virtual size: 2KB

/81
Size: 69KB - Virtual size: 69KB

/92
Size: 4KB - Virtual size: 3KB