SppExtComObjHook[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SppExtComObjHook.dll
Size

11KB
MD5

4ec83379dbf9c4586700e06dff7cacfc
SHA1

88b49e3e7d6cb8393cf1cd4299276b1fa2cc7c04
SHA256

a1ac7d633ca3d12c9bae48810f1b6b520e6e4a98f24dfe99e7cf7e721dd6fdd3
SHA512

2ee736e5b732a9e1e8af0d097510f03b673f8fa7776888d31fb7285d13d8f31e774c28c4d05a82709c0754ae35a6889d9315e93c8d6d025a7453643842a62778
SSDEEP

192:Nu10p5qblTlOe0FFESgUGQOnumPX4u3G+V3V5Bd7JEy92pUxrqeuvg+aAnGEm:Nt+pTlOySgUGhnuvu3G+V3zNDtAJvg+y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Device/HarddiskVolume5/Windows/System32/SppExtComObjHook.dll

Files

SppExtComObjHook.dll
.zip

Password: India@2023@@
Device/HarddiskVolume5/Windows/System32/SppExtComObjHook.dll
.dll windows:6 windows x64 arch:x64

Password: India@2023@@

09aa7a1a68855623e3ac071d6080ef31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

LdrDisableThreadCalloutsForDll
NtProtectVirtualMemory
RtlInitUnicodeString
LdrGetDllHandle
LdrLoadDll
RtlInitAnsiString
LdrGetProcedureAddress
RtlTimeToTimeFields
NtSetEvent
RtlRandomEx
NtQueryPerformanceCounter
NtQuerySystemTime
RtlTimeFieldsToTime
RtlAllocateHeap
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
NtClose
swprintf_s
strcmp
_wcsnicmp
memmove
memcpy
memset
wcslen
_wcsicmp
memcmp

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json