ssload | acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7.dll
Size 446KB
Sample240503-vg2ckabd8s
SHA256 acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7
MD5 ea5a4c15ba2b29c65462cb24e0025644
SHA1 22c9dd7a1f679a1fa24518da4c36f908071e2597
SHA512 35d4ab13a3026ca3d435eddf6089229180fbba3bcb5c619b2a7dda82a411573acea23488910e3e648dae9a99f7966094600ef69fa7ba19b4a680deb31c1de4e6
SSDEEP 12288:dtcLP7XVZpyrO+2ufEFoOrm0u9F+dAHQ8KsRh:dtcD7rpyrO+Beta+dAwbG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader ssload

Malware Config

Signatures

Detects SSLoad Unpacked payload 1 IoCs

loader

resource	yara_rule
sample	family_ssload

Ssload family
ssload

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7.dll

File Explorer

acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7.dll

.dll 446KB

acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7.dll

IMPHASH 90f845e5870e847e5e81de0e376ea70b
SHA256 acf1dcddc30b4aed73f9216539bb1974f7e9b8c25857184afc74764da1b64cc7
MD5 ea5a4c15ba2b29c65462cb24e0025644
SHA1 22c9dd7a1f679a1fa24518da4c36f908071e2597
SHA512 35d4ab13a3026ca3d435eddf6089229180fbba3bcb5c619b2a7dda82a411573acea23488910e3e648dae9a99f7966094600ef69fa7ba19b4a680deb31c1de4e6
SSDEEP 12288:dtcLP7XVZpyrO+2ufEFoOrm0u9F+dAHQ8KsRh:dtcD7rpyrO+Beta+dAwbG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects SSLoad Unpacked payload

loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

287538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleHandleW LoadLibraryW GetProcAddress FreeLibrary CloseHandle GetCurrentProcessId GetCurrentThreadId GetCurrentThread SetThreadPriority Sleep GetConsoleOutputCP WriteFile SetStdHandle HeapSize GetStringTypeW LCMapStringW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetModuleHandleExW RaiseException LoadLibraryExW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList RtlUnwind IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead DecodePointer GetEnvironmentStringsW GetEnvironmentVariableW ReleaseMutex RtlCaptureContext GetCommandLineW FlushFileBuffers SetFileInformationByHandle DuplicateHandle SetFilePointerEx ReadFileEx SleepEx GetCurrentProcess AcquireSRWLockExclusive SetWaitableTimer CreateWaitableTimerExW SwitchToThread SetThreadStackGuarantee CompareStringOrdinal DeleteProcThreadAttributeList GetModuleFileNameW GetVersionExW GetProcessHeap GetStdHandle HeapFree LoadLibraryA WriteFileEx GetExitCodeProcess TerminateProcess FreeEnvironmentStringsW GetCurrentDirectoryW QueryPerformanceCounter CreateEventW HeapReAlloc AcquireSRWLockShared ReleaseSRWLockShared GetLastError CreateMutexA TlsSetValue GetModuleHandleA FindNextFileW FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx WaitForSingleObject CreateDirectoryW FindFirstFileW CopyFileExW ReadFile GetOverlappedResult CancelIo WaitForSingleObjectEx FormatMessageW GetConsoleMode GetFileType HeapAlloc CreateMutexW TryAcquireSRWLockExclusive ExitProcess GetFullPathNameW SetLastError CreateNamedPipeW WaitForMultipleObjects GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree TlsGetValue GetSystemTimeAsFileTime GetTempPathW ReleaseSRWLockExclusive

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpQueryHeaders WinHttpCloseHandle WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpOpen

shell32

ShellExecuteW IsUserAnAdmin

advapi32

SystemFunction036

ntdll

RtlNtStatusToDosError NtWriteFile NtCreateFile NtReadFile

bcrypt

BCryptGenRandom