dll[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dll.zip
Size

11.6MB
MD5

8cba1c85126c8758aed3b392deb9fbb6
SHA1

96f6ab188b71aa784df1eecb3f411129174814f0
SHA256

8e36bc502d1ca089b566092eb95e7bdfe84e933e2b701594068e65e31a838119
SHA512

bd02c4e6391718e7bc331052b1d18bf79ff565748bfbca57e83d21391aa43bd86fc35ee214294e31b25b50669e7704dcba9041d4725f465d6637c431d1cec5c4
SSDEEP

196608:z2jrOvSCqLt8EttLhsC7UjYjZb17cEtzKPikNiJQ7AhX3oLWrXicRhbD4UAbQbL:ajdtVkMjZb17xtOtNiJQ7AhnoWrSkFDZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dll.dll

Files

dll.zip
.zip
dll.dll
.dll windows:6 windows x86 arch:x86

d9559cf85af3d7fd70fca8dd4b9c6052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
CreateThread
SizeofResource
VirtualProtect
VirtualAlloc
FindResourceA
LoadLibraryA
LockResource
LoadResource
GetProcAddress
GetCurrentProcessId
AllocConsole
VirtualFree
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent

user32

wsprintfA
MessageBoxA

msvcp140

?_Xlength_error@std@@YAXPBD@Z

ws2_32

send
recv
connect

vcruntime140

__std_exception_copy
__current_exception_context
__CxxFrameHandler3
memcpy
_CxxThrowException
__std_type_info_destroy_list
__current_exception
memset
__std_exception_destroy
_except_handler4_common
memmove

api-ms-win-crt-stdio-l1-1-0

freopen_s
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_crt_atexit
_initterm
_initterm_e
_cexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_execute_onexit_table

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

Exports

Exports

?time_export@@3IA

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30.3MB - Virtual size: 30.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9559cf85af3d7fd70fca8dd4b9c6052

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 30.3MB - Virtual size: 30.3MB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 30.3MB - Virtual size: 30.3MB

.reloc
Size: 14KB - Virtual size: 14KB