90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll
Size 54KB
Sample240229-gaapdagb22
SHA256 90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020
MD5 f58e0dfb8f915fa5ce1b7ca50c46b51b
SHA1 9acb977f13fce7ec38275887ddbbc0f42532e907
SHA512 4ebab09c4319c4604e7dad00f669e572ecf79d9db74a1a6f6ad833ea4be2ce3ead1548196a9b15a052ad006af28afa2005bd5523b8215e1f51fce9671a73580d
SSDEEP 768:rC8sPHjgxRIO5h7Ji10Ed4WKn84n2ZePq+RTdFvnM+cmVqDj64Bj:ri/Mf7oiEdXKn84n2ad/vbcmVWjXBj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll

File Explorer

90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll

.dll 54KB

90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll

IMPHASH 580b32aebb5f47963867d746773cf6a1
SHA256 90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020
MD5 f58e0dfb8f915fa5ce1b7ca50c46b51b
SHA1 9acb977f13fce7ec38275887ddbbc0f42532e907
SHA512 4ebab09c4319c4604e7dad00f669e572ecf79d9db74a1a6f6ad833ea4be2ce3ead1548196a9b15a052ad006af28afa2005bd5523b8215e1f51fce9671a73580d
SSDEEP 768:rC8sPHjgxRIO5h7Ji10Ed4WKn84n2ZePq+RTdFvnM+cmVqDj64Bj:ri/Mf7oiEdXKn84n2ad/vbcmVWjXBj
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ExitProcess GetModuleHandleW GetModuleFileNameW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileInformationByHandle CloseHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetCurrentProcessId TerminateProcess OpenProcess CopyFileA Sleep CreateFileW CreateDirectoryW AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

user32

GetClientRect GetDesktopWindow CreateWindowExA DefWindowProcA SetWindowTextA ShowWindow GetMessageA RegisterClassExA MessageBoxA GetWindowLongW SendMessageA DispatchMessageW

gdi32

CreateFontA

advapi32

RegSetValueExA RegOpenKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z _Thrd_detach ?_Throw_C_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPBD@Z _Cnd_do_broadcast_at_thread_exit ?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAHH@Z

vcruntime140

memcpy _except_handler4_common __std_type_info_destroy_list _CxxThrowException memmove __std_exception_destroy __std_exception_copy __std_terminate __CxxFrameHandler3 memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _execute_onexit_table _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _cexit _invalid_parameter_noinfo_noreturn _initialize_narrow_environment terminate _beginthreadex

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

AcceptSecurityContext AcquireCredentialsHandleA AcquireCredentialsHandleW AddCredentialsA AddCredentialsW AddSecurityPackageA ApplyControlToken ChangeAccountPasswordA ChangeAccountPasswordW CloseLsaPerformanceData CollectLsaPerformanceData CompleteAuthToken CredMarshalTargetInfo CredUnmarshalTargetInfo DecryptMessage DeleteSecurityContext DeleteSecurityPackageA DeleteSecurityPackageW EncryptMessage EnumerateSecurityPackagesA EnumerateSecurityPackagesW ExportSecurityContext FreeContextBuffer FreeCredentialsHandle GetComputerObjectNameA GetComputerObjectNameW GetSecurityUserInfo GetUserNameExA GetUserNameExW ImpersonateSecurityContext ImportSecurityContextA ImportSecurityContextW InitSecurityInterfaceA InitSecurityInterfaceW InitializeSecurityContextA InitializeSecurityContextW LsaCallAuthenticationPackage LsaConnectUntrusted LsaDeregisterLogonProcess LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification LsaUnregisterPolicyChangeNotification MakeSignature OpenLsaPerformanceData QueryContextAttributesA QueryContextAttributesW QueryCredentialsAttributesA QueryCredentialsAttributesW QuerySecurityContextToken QuerySecurityPackageInfoA QuerySecurityPackageInfoW RevertSecurityContext SaslAcceptSecurityContext SaslEnumerateProfilesA SaslEnumerateProfilesW SaslGetContextOption SaslGetProfilePackageA SaslGetProfilePackageW SaslIdentifyPackageA SaslIdentifyPackageW SaslInitializeSecurityContextA SaslInitializeSecurityContextW SaslSetContextOption SealMessage SeciAllocateAndSetCallFlags SeciAllocateAndSetIPAddress SeciFreeCallContext SecpFreeMemory SecpTranslateName SecpTranslateNameEx SetContextAttributesA SetContextAttributesW SetCredentialsAttributesA SetCredentialsAttributesW SspiCompareAuthIdentities SspiCopyAuthIdentity SspiDecryptAuthIdentity SspiEncodeAuthIdentityAsStrings SspiEncodeStringsAsAuthIdentity SspiEncryptAuthIdentity SspiExcludePackage SspiFreeAuthIdentity SspiGetTargetHostName SspiIsAuthIdentityEncrypted SspiLocalFree SspiMarshalAuthIdentity SspiPrepareForCredRead SspiPrepareForCredWrite SspiUnmarshalAuthIdentity SspiValidateAuthIdentity SspiZeroAuthIdentity TranslateNameA TranslateNameW UnsealMessage VerifySignature