winboot[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

winboot.dll
Size

8.7MB
MD5

5c15278726732aa09140564b3bb9a338
SHA1

67e94b5e3921a3acb135e9876a4e890ce27788c8
SHA256

297816cb2b97d2f440e8dcfcfb7146d2b0642bea840338b06c97dbf67ad4e5c4
SHA512

fb9f2cd39b7b8d4523450117d8f1ac7292dc93de16955ce56606fb85e1d73d3c4bfb0f54f47f3eaa8aa5602803337509dffe4ae2efb913775130ff6aaf924f8f
SSDEEP

196608:3cU0eb77COgJ6hO8tfsn1wymmdvqDucwhV8JZ3mxSanlJdeCTa:MU/b77CIhO861zpqDuc8V4h8ZfJ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winboot.dll

Files

winboot.dll
.dll windows:6 windows x86 arch:x86

9787e0967d41a8730876e73f4c78a296

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowLongA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetPixel

ole32

CoSetProxyBlanket

oleaut32

SysAllocString

ws2_32

bind

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

wininet

InternetCloseHandle

d3d10

D3D10CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

d3dx10_43

D3DX10CreateShaderResourceViewFromMemory

ntdll

NtReadVirtualMemory

winmm

PlaySoundA

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow

vcruntime140

_setjmp3

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand

wtsapi32

WTSSendMessageW

Exports

Exports

SEMLBMLRA

Sections

.text
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 822KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9787e0967d41a8730876e73f4c78a296

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

oleaut32

ws2_32

msvcp140

wininet

d3d10

d3dcompiler_47

d3dx10_43

ntdll

winmm

dwmapi

imm32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 1.6MB

.rdata Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 822KB

.vmp0 Size: - Virtual size: 4.9MB

.vmp1 Size: 8.7MB - Virtual size: 8.7MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 1.6MB

.rdata
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 822KB

.vmp0
Size: - Virtual size: 4.9MB

.vmp1
Size: 8.7MB - Virtual size: 8.7MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 469B