falcon[.]dll | Triage™

Resubmissions

05/04/2024, 15:25

240405-sttgdaga8710

27/02/2024, 18:55

240227-xkrcwaha5y7

Sharing

Copy URL Twitter E-mail

General

Target
falcon.dll
Size 457KB
Sample240405-sttgdaga87
SHA256 97e08d1c7970c1c12284c4644e2321ce41e40cdaac941e451db4d334cb9c5492
MD5 6e008b699fb7ba79a0fbd9ddc7fe975a
SHA1 46b5367c51540b5b78c64d01e70115b5fcc42aa3
SHA512 e18ad15f4a4190263d583e38388da5ba434028a209266717a81d3faad16d96e8c7d75e686067b7c9a20546bf46c8b8c14407a2dd427125c60448b6d3b0bfbb9a
SSDEEP 12288:KZ8ufZp3T+w/rIesY7Kcg/L0EEJ0War2:Y8sr3T+2s3c9HJna6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
falcon.dll

File Explorer

falcon.dll

.dll 457KB

falcon.dll

IMPHASH 9fdfe1ae59af686424d6740da33978b0
SHA256 97e08d1c7970c1c12284c4644e2321ce41e40cdaac941e451db4d334cb9c5492
MD5 6e008b699fb7ba79a0fbd9ddc7fe975a
SHA1 46b5367c51540b5b78c64d01e70115b5fcc42aa3
SHA512 e18ad15f4a4190263d583e38388da5ba434028a209266717a81d3faad16d96e8c7d75e686067b7c9a20546bf46c8b8c14407a2dd427125c60448b6d3b0bfbb9a
SSDEEP 12288:KZ8ufZp3T+w/rIesY7Kcg/L0EEJ0War2:Y8sr3T+2s3c9HJna6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

126896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\snxhk.pdb

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlNtStatusToDosError RtlPrefixUnicodeString RtlInitUnicodeString RtlCaptureContext RtlVirtualUnwind RtlEqualUnicodeString RtlPcToFileHeader

kernel32

Sleep WriteConsoleW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId SetLastError GetLastError OutputDebugStringW TerminateProcess ResumeThread CreateProcessW OpenProcess ExitProcess CloseHandle WaitForSingleObject MultiByteToWideChar VirtualQuery VirtualProtect GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualFree GetThreadContext SetThreadContext GetCurrentThread SuspendThread WriteFile LoadLibraryExW FreeLibrary GetProcAddress GetModuleHandleW WideCharToMultiByte QueryPerformanceCounter DeviceIoControl OpenThread CreateEventW CreateThread GetTickCount GetCurrentProcessId GetProcessTimes DeleteCriticalSection GetThreadTimes GlobalAddAtomW FindResourceW FindResourceA LoadResource LockResource LoadLibraryW SetEvent CreateFileW ReadFile GetSystemTimeAsFileTime GetFileAttributesW GetPrivateProfileIntW ExpandEnvironmentStringsW GetConsoleMode GetModuleFileNameA GetModuleFileNameW GetCommandLineW QueueUserAPC GetSystemDirectoryW GetACP GetModuleHandleExW GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetStdHandle SetFilePointerEx GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException InterlockedFlushSList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapAlloc HeapFree GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap

Name

.text

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

falcon.dll

ntdll

kernel32

generic