plink[.]dll | Triage™

General

Target
plink.dll
Size 198KB
Sample231216-efcd2sbfh6
SHA256 6acab64ff2901820e5d105bfbaa099f6b3a39473a5c7da444d11c5df03c6b8e7
MD5 702e5102e7022211aaaae80eb94594de
SHA1 91c308df34ac7f8ed45f8b44c474522bdb357c6f
SHA512 7e63548d70923be540feb2195d0ef043895d6b9d4a821aae52489481dbe32b0652de5c44021d4abedbc433d7c9285d67d5383b5627ae75819883ac828c3ef864
SSDEEP 3072:wcLIvYMGm25ly9fJGcrWIR95szj2zSroZUc8ZANMhGnwdVhcroyU89/IuwkP8/uB:wLvP25lyd0OBPywHqVFR/u+/M
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
plink.dll

File Explorer

plink.dll

.dll 198KB

plink.dll

IMPHASH 60d2169e1814125b17d387c47915a446
SHA256 6acab64ff2901820e5d105bfbaa099f6b3a39473a5c7da444d11c5df03c6b8e7
MD5 702e5102e7022211aaaae80eb94594de
SHA1 91c308df34ac7f8ed45f8b44c474522bdb357c6f
SHA512 7e63548d70923be540feb2195d0ef043895d6b9d4a821aae52489481dbe32b0652de5c44021d4abedbc433d7c9285d67d5383b5627ae75819883ac828c3ef864
SSDEEP 3072:wcLIvYMGm25ly9fJGcrWIR95szj2zSroZUc8ZANMhGnwdVhcroyU89/IuwkP8/uB:wLvP25lyd0OBPywHqVFR/u+/M
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

45488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FormatMessageW OutputDebugStringW LocalAlloc LocalFree GetConsoleWindow GetConsoleScreenBufferInfo WriteConsoleW WideCharToMultiByte WriteFile GetLastError GetCurrentThreadId HeapFree GetProcessHeap UnhandledExceptionFilter CloseHandle WaitForSingleObjectEx SetEvent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapAlloc TryEnterCriticalSection QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetTickCount TlsAlloc TlsFree TlsGetValue TlsSetValue Sleep SwitchToThread ExitProcess GetStdHandle CreateThread QueueUserWorkItem CreateEventW GetNativeSystemInfo QueryPerformanceFrequency GetSystemTimeAdjustment GetEnvironmentVariableW lstrlenW lstrcmpiW GetStringTypeExW ResetEvent LoadLibraryExW GetModuleHandleW GetProcAddress EncodePointer DecodePointer GetUserDefaultUILanguage FindFirstFileW FindNextFileW FindClose GetModuleFileNameW FindResourceExW LoadResource CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList SetLastError FreeLibrary RaiseException GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar GetACP GetFileType GetStringTypeW LCMapStringW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers

user32

MessageBoxW

q2VectParallel qvcomp_atomic_add_i1 qvcomp_atomic_add_i2 qvcomp_atomic_add_i4 qvcomp_atomic_add_i8 qvcomp_atomic_add_r4 qvcomp_atomic_add_r8 qvcomp_atomic_and_i1 qvcomp_atomic_and_i2 qvcomp_atomic_and_i4 qvcomp_atomic_and_i8 qvcomp_atomic_div_i1 qvcomp_atomic_div_i2 qvcomp_atomic_div_i4 qvcomp_atomic_div_i8 qvcomp_atomic_div_r4 qvcomp_atomic_div_r8 qvcomp_atomic_div_ui1 qvcomp_atomic_div_ui2 qvcomp_atomic_div_ui4 qvcomp_atomic_div_ui8 qvcomp_atomic_mul_i1 qvcomp_atomic_mul_i2 qvcomp_atomic_mul_i4 qvcomp_atomic_mul_i8 qvcomp_atomic_mul_r4 qvcomp_atomic_mul_r8 qvcomp_atomic_or_i1 qvcomp_atomic_or_i2 qvcomp_atomic_or_i4 qvcomp_atomic_or_i8 qvcomp_atomic_shl_i1 qvcomp_atomic_shl_i2 qvcomp_atomic_shl_i4 qvcomp_atomic_shl_i8 qvcomp_atomic_shr_i1 qvcomp_atomic_shr_i2 qvcomp_atomic_shr_i4 qvcomp_atomic_shr_i8 qvcomp_atomic_shr_ui1 qvcomp_atomic_shr_ui2 qvcomp_atomic_shr_ui4 qvcomp_atomic_shr_ui8 qvcomp_atomic_sub_i1 qvcomp_atomic_sub_i2 qvcomp_atomic_sub_i4 qvcomp_atomic_sub_i8 qvcomp_atomic_sub_r4 qvcomp_atomic_sub_r8 qvcomp_atomic_xor_i1 qvcomp_atomic_xor_i2 qvcomp_atomic_xor_i4 qvcomp_atomic_xor_i8 qvcomp_barrier qvcomp_copyprivate_broadcast qvcomp_copyprivate_receive qvcomp_enter_critsect qvcomp_flush qvcomp_for_dynamic_init qvcomp_for_dynamic_init_i8 qvcomp_for_dynamic_next qvcomp_for_dynamic_next_i8 qvcomp_for_static_end qvcomp_for_static_init qvcomp_for_static_init_i8 qvcomp_for_static_simple_init qvcomp_for_static_simple_init_i8 qvcomp_fork qvcomp_get_thread_num qvcomp_leave_critsect qvcomp_master_barrier qvcomp_master_begin qvcomp_master_end qvcomp_ordered_begin qvcomp_ordered_end qvcomp_ordered_loop_end qvcomp_reduction_i1 qvcomp_reduction_i2 qvcomp_reduction_i4 qvcomp_reduction_i8 qvcomp_reduction_r4 qvcomp_reduction_r8 qvcomp_reduction_u1 qvcomp_reduction_u2 qvcomp_reduction_u4 qvcomp_reduction_u8 qvcomp_sections_init qvcomp_sections_next qvcomp_set_num_threads qvcomp_single_begin qvcomp_single_end qmp_destroy_lock qmp_destroy_nest_lock qmp_get_dynamic qmp_get_max_threads qmp_get_nested qmp_get_num_procs qmp_get_num_threads qmp_get_thread_num qmp_get_wtick qmp_get_wtime qmp_in_parallel qmp_init_lock qmp_init_nest_lock qmp_set_dynamic qmp_set_lock qmp_set_nest_lock qmp_set_nested qmp_set_num_threads qmp_test_lock qmp_test_nest_lock qmp_unset_lock scab

Sharing