Styx[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Styx.dll
Size

392KB
MD5

84bff67402200f22b1a3b8d2a82003e8
SHA1

0803cda865b638961d1ae894c2bf6485214c690c
SHA256

5b5c2f53162b39859000a3101c27bfaf4ca6fafb6be8407f0516fa6057fc698b
SHA512

970f405bf702d32945db23b712244ea9ebd02d36b7ca3138681c5c385f22bb647e8ba75df17fa2f1f5c12a459e2ca3d01370cd81565eade78f9543c056fafbbf
SSDEEP

6144:lpEIRaNudnqAaO9lnYeskTHcl9oYFPynqGVSvPY2n+2niq4vVO63gx:lpEIMNIt097SqdA2n+2nVeU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Styx.dll

Files

Styx.dll
.dll windows:6 windows x64 arch:x64

2448bc5d377a8bcafaea9c134039b45d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\zuken\OneDrive\Bureau\slinky old(source)\minion\minion\x64\Release\minion.pdb

Imports

opengl32

glPushAttrib
glOrtho
glPixelStorei
glShadeModel
glPushMatrix
glDisable
glDrawElements
glTexEnvi
glColorPointer
glTexImage2D
glGetTexEnviv
glTexCoordPointer
glDeleteTextures
glTexParameteri
glLoadIdentity
glBlendFunc
glMatrixMode
glDisableClientState
glScissor
glEnable
glVertexPointer
glGenTextures
glBindTexture
glPolygonMode
glPopAttrib
glEnableClientState
glViewport
glPopMatrix
glGetIntegerv

kernel32

InitOnceBeginInitialize
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitOnceComplete
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
OpenThread
SetThreadContext
FlushInstructionCache
RtlCaptureContext
TerminateProcess
InitializeSListHead
GetModuleHandleA
Sleep
GetProcAddress
CreateThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetCurrentProcessId
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
HeapReAlloc

user32

ScreenToClient
ClientToScreen
GetKeyboardLayout
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetMessageW
PostMessageW
CallNextHookEx
SetWindowLongPtrA
GetForegroundWindow
GetAsyncKeyState
FindWindowW
GetKeyState
GetWindowRect
CallWindowProcA
FindWindowA
SetWindowsHookExW
TranslateMessage
UnhookWindowsHookEx
DispatchMessageW

msvcp140

?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Xtime_get_ticks
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
_Thrd_sleep
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr
__std_exception_copy
__std_type_info_destroy_list
memset
_CxxThrowException
__C_specific_handler
__std_exception_destroy
memmove
memcpy
memcmp
memchr
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
abort

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vsscanf
fflush
fclose
_wfopen
fwrite
fseek
fread
__stdio_common_vfprintf
ftell

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
strncpy

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

atan2
atan2f
ceilf
cosf
acosf
pow
powf
sinf
sqrt
sqrtf
fmodf

Sections

.text
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2448bc5d377a8bcafaea9c134039b45d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

opengl32

kernel32

user32

msvcp140

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 315KB - Virtual size: 315KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 1KB - Virtual size: 7KB

.pdata Size: 13KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 1024B - Virtual size: 608B

.text
Size: 315KB - Virtual size: 315KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 1KB - Virtual size: 7KB

.pdata
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 1024B - Virtual size: 608B