e617bb359156052a7526c4f0267979ae2e5f3589[.]dll[.]vir

Resubmissions

20/12/2023, 03:20

231220-dvq1bahhan 8

20/12/2023, 03:06

231220-dlyzkahecj 8

Sharing

Copy URL Twitter E-mail

General

Target

e617bb359156052a7526c4f0267979ae2e5f3589.dll.vir
Size

877KB
MD5

96b6ed1f97dee5b547f6fecbbfe6ceb1
SHA1

e617bb359156052a7526c4f0267979ae2e5f3589
SHA256

cdefe04ff6ea56f6bd8d69648e9603a8ed6db07e90349592062ce1829693bbc5
SHA512

17840adad49971c8a8c4e68014d111beb5c9730cfdd9ee7a6d46c08ea213c8bf290484f338250e8cdc3c1e855e35065875936269edfacaeae169f2b7af3b72bf
SSDEEP

12288:/HWgyKilKLVIYK+QiTbzmWR5eIi3Ld0MIEX6SZW4Abw0jaffcBc0v0BJ:/HGbWQifSbIix0FEXtILjx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e617bb359156052a7526c4f0267979ae2e5f3589.dll.vir

Files

e617bb359156052a7526c4f0267979ae2e5f3589.dll.vir
.dll windows:5 windows x86 arch:x86

498cf6dd547c9e21cebe9be8ac410ed6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_except_handler3
wcsncpy
_snprintf
strrchr
sprintf
_snwprintf
_wsplitpath
wcsrchr
wcscmp
memmove
malloc
free
wcslen
wcschr
wcsstr
wcscpy
_wcsicmp
_vsnwprintf
wcscat
_vsnprintf
swprintf
_initterm
_adjust_fdiv
__dllonexit
_onexit
towupper

ntdll

VerSetConditionMask

advapi32

DestroyPrivateObjectSecurity
CreatePrivateObjectSecurity
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidLengthRequired
InitializeSid
ControlService
QueryServiceStatus
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
DeregisterEventSource
RegisterEventSourceW
RegOpenKeyExA
RegQueryValueA
DeleteService
AllocateAndInitializeSid
FreeSid
SetKernelObjectSecurity
RegCloseKey
RegCreateKeyExW
RegEnumKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyW
OpenThreadToken
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
OpenProcessToken
AddAce
GetAce
GetAclInformation
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetKernelObjectSecurity
RegDeleteValueW
RegQueryValueW
SetServiceStatus
RegisterServiceCtrlHandlerExW
AccessCheck

kernel32

SetEndOfFile
GetTimeFormatW
UnlockFileEx
LockFileEx
LocalFree
LocalAlloc
GetCurrentThreadId
EnterCriticalSection
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetVolumeInformationW
SetErrorMode
GetDriveTypeW
lstrcmpiW
lstrcpyW
lstrlenW
GetLastError
VerifyVersionInfoW
lstrcatW
lstrcpynW
InterlockedDecrement
GetLogicalDriveStringsW
SetEvent
ResetEvent
CloseHandle
CreateMutexW
FreeLibrary
InterlockedIncrement
IsBadWritePtr
CreateEventW
InterlockedExchange
WaitForSingleObject
InterlockedCompareExchange
IsWow64Process
GetCurrentProcess
GetModuleFileNameW
CreateThread
MapViewOfFileEx
DuplicateHandle
OpenProcess
GetCurrentThread
UnmapViewOfFile
IsBadReadPtr
CreateFileMappingW
GetFileType
CreateFileW
DeleteFileW
MulDiv
lstrcmpW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
HeapDestroy
lstrlenA
GetModuleHandleW
GetTickCount
FormatMessageW
SetLastError
DisableThreadLibraryCalls
Sleep
GetCurrentProcessId
WaitForSingleObjectEx
GetLocalTime
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyA
WaitForMultipleObjects
SystemTimeToFileTime
GetSystemTime
IsBadStringPtrW
WriteFile
lstrcpynA
SetFilePointer
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadCodePtr
ClearCommError
PurgeComm
EscapeCommFunction
SetCommMask
SetCommTimeouts
SetupComm
LeaveCriticalSection
CreateMutexA
ReleaseMutex
FlushFileBuffers
SetFilePointerEx
CreateFileA
ExpandEnvironmentStringsA
GetModuleFileNameA
CompareStringW
ReadFile
GetProcAddress
LoadLibraryW
LoadLibraryA
CompareStringA
ExpandEnvironmentStringsW
OutputDebugStringW
GetFileInformationByHandle
GetDateFormatW

user32

CharNextW
LoadStringW
UnregisterDeviceNotification
RegisterDeviceNotificationW
wsprintfW
ShowWindow
IsWindow
PostQuitMessage
DestroyWindow
AllowSetForegroundWindow
CharUpperW
DefWindowProcW
BroadcastSystemMessageW
wvsprintfW

oleaut32

SysStringLen
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysFreeString
SysAllocString

shlwapi

SHDeleteKeyW

ole32

CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoAddRefServerProcess
CoCreateInstance
CoTaskMemFree
StringFromCLSID
StgCreatePropStg
StgOpenPropStg
CoRevertToSelf
CoImpersonateClient
CoUninitialize
CoInitializeSecurity
CoCreateInstanceEx
CLSIDFromString
StringFromGUID2
MkParseDisplayName
CoInitializeEx
FreePropVariantArray
CoInitialize
CoTaskMemAlloc
PropVariantClear
CreateBindCtx
CreateStreamOnHGlobal

rpcrt4

RpcAsyncAbortCall
RpcStringFreeW
RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcImpersonateClient
RpcRevertToSelf
NdrClientCall2
NdrAsyncServerCall
NdrServerCall2
RpcServerTestCancel
UuidToStringA
RpcStringFreeA
UuidCreateNil
UuidCreate
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerListen
RpcBindingInqAuthClientW
RpcBindingToStringBindingW
RpcStringBindingParseW

cfgmgr32

CM_Get_DevNode_Status
CM_Set_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_IDW
CM_Get_Device_ID_Size_Ex
CM_Locate_DevNodeW
CM_Open_DevNode_Key
CM_Get_DevNode_Registry_PropertyA
CM_Open_DevNode_Key_Ex
CM_Reenumerate_DevNode

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailW
SetupDiDeleteDeviceInterfaceData

mscms

GetStandardColorSpaceProfileW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

??0BUFFER@@QAE@I@Z
??0BUFFER_CHAIN@@QAE@XZ
??0BUFFER_CHAIN_ITEM@@QAE@I@Z
??1BUFFER@@QAE@XZ
??1BUFFER_CHAIN@@QAE@XZ
??1BUFFER_CHAIN_ITEM@@QAE@XZ
??_FBUFFER@@QAEXXZ
??_FBUFFER_CHAIN_ITEM@@QAEXXZ
?QueryPtr@BUFFER@@QBEPAXXZ
?QuerySize@BUFFER@@QBEIXZ
?QueryUsed@BUFFER_CHAIN_ITEM@@QBEKXZ
?SetUsed@BUFFER_CHAIN_ITEM@@QAEXK@Z
DllEntryPoint
Enter
DllUnregisterServer
ServiceMain
SvchostPushServiceGlobals
wiasCreateChildAppItem
wiasCreateDrvItem
wiasCreateLogInstance
wiasCreatePropContext
wiasDebugError
wiasDebugTrace
wiasDownSampleBuffer
wiasFormatArgs
wiasFreePropContext
wiasGetChangedValueFloat
wiasGetChangedValueGuid
wiasGetChangedValueLong
wiasGetChangedValueStr
wiasGetChildrenContexts
wiasGetContextFromName
wiasGetDrvItem
wiasGetImageInformation
wiasGetItemType
wiasGetPropertyAttributes
wiasGetRootItem
wiasIsPropChanged
wiasParseEndorserString
wiasPrintDebugHResult
wiasQueueEvent
wiasReadMultiple
wiasReadPropBin
wiasReadPropFloat
wiasReadPropGuid
wiasReadPropLong
wiasReadPropStr
wiasSendEndOfPage
wiasSetItemPropAttribs
wiasSetItemPropNames
wiasSetPropChanged
wiasSetPropertyAttributes
wiasSetValidFlag
wiasSetValidListFloat
wiasSetValidListGuid
wiasSetValidListLong
wiasSetValidListStr
wiasSetValidRangeFloat
wiasSetValidRangeLong
wiasUpdateScanRect
wiasUpdateValidFormat
wiasValidateItemProperties
wiasWriteBufToFile
wiasWriteMultiple
wiasWritePageBufToFile
wiasWritePropBin
wiasWritePropFloat
wiasWritePropGuid
wiasWritePropLong
wiasWritePropStr

Sections

.text
Size: 297KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 555KB - Virtual size: 554KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

498cf6dd547c9e21cebe9be8ac410ed6

Headers

File Characteristics

Imports

msvcrt

ntdll

advapi32

kernel32

user32

oleaut32

shlwapi

ole32

rpcrt4

cfgmgr32

setupapi

mscms

version

Exports

Exports

Sections

.text Size: 297KB - Virtual size: 300KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 555KB - Virtual size: 554KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 297KB - Virtual size: 300KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 555KB - Virtual size: 554KB

.reloc
Size: 20KB - Virtual size: 19KB