615854eefe11f3eb59abd20350686392856a6c7175f905bd11520043598f499a[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

615854eefe11f3eb59abd20350686392856a6c7175f905bd11520043598f499a.dll
Size

241KB
MD5

861f27cf9369cb0a11417ddb9b94fb48
SHA1

f0d55b2a8c2062a629579717c9cb7332197bf096
SHA256

615854eefe11f3eb59abd20350686392856a6c7175f905bd11520043598f499a
SHA512

6e5e78ffa03c80a32ba5758a5eab1b08eb2d9758c4a10496b1d7ecdb76ab26fa96de54688c0a547bd3137a9ee54d15e184185e0da38376ba3695b57e0864f639
SSDEEP

6144:ccDG/OzevLYZMl4G3/IS5ulV0ZZaaXt1BqWtgF8FKb:ccD+Ozevc+WGPI62OZoad1kW6l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
615854eefe11f3eb59abd20350686392856a6c7175f905bd11520043598f499a.dll

Files

615854eefe11f3eb59abd20350686392856a6c7175f905bd11520043598f499a.dll
.dll windows:5 windows x64 arch:x64

a42d4d6071b7dd15ff139883773ee067

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ExitThread
CreateProcessA
Sleep
InitializeCriticalSection
DeleteCriticalSection
ReadFile
CreatePipe
PeekNamedPipe
WaitForSingleObject

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

ReflectiveLoader

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ