4900001[.]dll | Triage

Resubmissions

08/05/2024, 09:12

240508-k6h76sff75 3

Sharing

Copy URL Twitter E-mail

General

Target

4900001.dll
Size

104KB
MD5

4edae21fd58b29500a0a3348bc5bc530
SHA1

850d2727c163a62982fb76b8c75ae92e239d12cc
SHA256

427b6dc489cbfad36413fce6f71e82e158a6632c9986c1dee1af7676a129f048
SHA512

d7101919f640a3f5adb69261705d74e7966adf4aebde7d39d0edb52ce93aec512bb0caa9ba2013391eedc262163a027860f5c80ceb1a734228d52f9fe1fff897
SSDEEP

1536:vmLdFqMtke52InUfOQqqrJzQmG6XvrZ5kKvtK8PndL0U:FJa2IUjDJzQor1K8PndQU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4900001.dll

Files

4900001.dll
.exe windows:5 windows x86 arch:x86

7b18dd755296fd130ff0a82bb126fb9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
VirtualFree
WideCharToMultiByte
LoadLibraryW
LeaveCriticalSection
MultiByteToWideChar
GetProcAddress
VirtualAlloc
EnterCriticalSection
lstrlenW
GetNativeSystemInfo
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
LoadLibraryA
VirtualProtect
WriteFile
CreateFileW
FlushFileBuffers
OutputDebugStringA
CloseHandle
SetStdHandle
GetModuleFileNameW
GetVersionExW
Sleep
GetTickCount
GetComputerNameW
FreeLibrary
CreateMutexW
GetStringTypeW
LCMapStringW
GetConsoleMode
WriteConsoleW
GetConsoleCP
SetFilePointer
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetStdHandle
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind

advapi32

GetUserNameW

Exports

Exports

GetFullLangFileNameW2
WinHttpFreeShareFree
WinHttpPostShare

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

7b18dd755296fd130ff0a82bb126fb9d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 16KB - Virtual size: 16KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 16KB

.reloc
Size: 8KB - Virtual size: 8KB