Main[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Main.dll
Size

3.1MB
MD5

357cd076bc192648329444cbf210523a
SHA1

27403b9a48a7be4c5cc06225c2bb797df8db3f2e
SHA256

aac918ece0dcd61538401f03c58a085e22968fc7bcb996c731cb5519bf06b5ac
SHA512

9dc28ec54649d897c1c6119b5331352cb9d6349f90266fa06f61164f0edff223685c694a15089fe40a03cc8de6343f63f0a33cf9f88e4f617d2727c40046530e
SSDEEP

49152:/UZkoIj0ePkwIk1vu7Seo1k0epLxQ2sf3:MkoI7j1kjpRs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Main.dll

Files

Main.dll
.dll windows:6 windows x86 arch:x86

e252b7b1fb298cd541e16907e35b29c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\KG-Emulator\1.04.05\VS.2017\Main\Main_EX603_KGEmulator\Release\Main.pdb

Imports

kernel32

WriteFile
QueryPerformanceFrequency
SetThreadPriority
QueryPerformanceCounter
VirtualProtect
GetPrivateProfileIntA
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateEventW
GetLastError
SetProcessWorkingSetSize
GetFileSize
ReadFile
DeleteFileA
FindFirstFileA
FindNextFileA
GetStdHandle
OpenMutexA
CreateMutexA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
DeviceIoControl
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
GetProcessHeap
FindResourceA
SizeofResource
LoadResource
LockResource
FreeResource
SetEndOfFile
SetStdHandle
MoveFileExW
DeleteFileW
CreateFileW
CreatePipe
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
CreateFileA
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
lstrlenA
CreateThread
RaiseException
GetCurrentProcess
TerminateProcess
Sleep
ExitProcess
CloseHandle
TerminateThread
GetFileType
ReadConsoleW
GetConsoleMode
GetTempPathW
CreateProcessW
DuplicateHandle
GetModuleFileNameW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
FormatMessageA
GetModuleHandleExA
GetModuleHandleA
FreeLibrary
GetCurrentProcessId
GetStartupInfoW
IsProcessorFeaturePresent
WriteConsoleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
WaitForSingleObjectEx
ResetEvent
SetEvent
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
InterlockedCompareExchange
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
MultiByteToWideChar
EncodePointer
WideCharToMultiByte
GetTickCount
GetConsoleCP
GetCurrentThread

user32

wsprintfA
GetForegroundWindow
keybd_event
FindWindowA
FindWindowExA
GetKeyboardLayout
GetClassNameA
GetKeyState
GetDC
MessageBoxA
LoadIconA
SendMessageA
SetWindowsHookExA
CallWindowProcA
CallNextHookEx
SetWindowPos
GetWindowTextA
SetWindowLongA
GetKeyboardState
LoadImageA
UpdateWindow
ShowWindow
IsWindowVisible
GetSystemMetrics
AdjustWindowRect
SetWindowTextA
MapVirtualKeyA
ToAsciiEx

gdi32

CreateFontA
SelectObject
GetTextExtentPoint32A
DeleteObject

advapi32

RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA

shell32

Shell_NotifyIconA

ws2_32

inet_addr
WSAStartup
socket
WSACreateEvent
htons
gethostbyname
connect
WSAGetLastError
WSAEventSelect
closesocket
recv
send
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
getpeername
ntohs
WSACloseEvent

winmm

timeGetTime

opengl32

glReadPixels
glColor3fv
glColor4fv
glFogi
glDepthMask
glVertex2f
glTexCoord2f
glColor3f
glPopMatrix
glClear
glAlphaFunc
glDepthFunc
glTranslatef
glRotatef
glLoadIdentity
glPushMatrix
glMatrixMode
glEnd
glColor4f
glBegin
glDisable
glFogf
glFogfv
glEnable
glTexParameteri
glGetFloatv

iphlpapi

GetAdaptersInfo
IcmpCreateFile
IcmpSendEcho

Exports

Exports

EntryProc
Init
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e252b7b1fb298cd541e16907e35b29c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

winmm

opengl32

iphlpapi

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 158KB - Virtual size: 158KB

.data Size: 1.5MB - Virtual size: 4.0MB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 74KB - Virtual size: 73KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 1.5MB - Virtual size: 4.0MB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 74KB - Virtual size: 73KB