static[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

static.dll
Size

43KB
MD5

bec0fbc1db70d99d081ccea481521256
SHA1

5920ca5858b29584e98f3a6d56639c32624af07b
SHA256

ad84dd9c10b1c220f4ac5c587afc5979955430903e0de70b5db9e748695d0d64
SHA512

495e4f78c5d6e41da092977d6e9e83e787ad67dbc620d258853971da8904c57fc92b3df41c3c429346af637324de3b9edf7380b9b781d83330426e65001ff409
SSDEEP

768:AJRfEWGG59uLcTv8AHBwAdxqJ5siuhvJlpv2Zqalv/jKWQh8DxDycJk3WUhbP:apEjG59uLgv8AhUMi4NoqSv/jKWQh8D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
static.dll

Files

static.dll
.dll windows:10 windows x64 arch:x64

35c9e74ceb4164a9c3a4fba110273b83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

static.pdb

Imports

msvcrt

malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
wcsncmp
_wcsicmp
wcschr
_i64toa
_atoi64
isdigit
isspace
_vsnprintf
_strnicmp
_wcsupr
wcsrchr
_stricmp
strstr
strchr
free
memset
wcscmp

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
DebugBreak

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockExclusive
Sleep
ReleaseSRWLockShared

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

iisutil

??1STRA@@QEAA@XZ
?Terminate@LANG_STRING@@QEAAJXZ
?Resize@STRU@@QEAAJK@Z
?QueryBuffer@STRU@@QEAAPEAVBUFFER@@XZ
?QueryStr@MULTISZA@@QEBAPEADXZ
??1MULTISZA@@QEAA@XZ
?CopyWTruncate@STRA@@QEAAJPEBG@Z
?Append@STRA@@QEAAJPEBDK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?SyncWithBuffer@STRU@@QEAAXXZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@PEAEK@Z
?QueryCCH@STRU@@QEBAKXZ
SAFE_snwprintf
StringTimeToFileTime
?CopyW@STRA@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?GetString@LANG_STRING@@QEAAJPEBDKIPEAPEBGPEAK@Z
?IsEmpty@STRA@@QEBA_NXZ
?AppendW@MULTISZA@@QEAAHPEBGK@Z
?Resize@BUFFER@@QEAA_NKK@Z
?QueryStr@STRU@@QEBAPEBGXZ
?QueryStr@STRU@@QEAAPEAGXZ
?Copy@STRU@@QEAAJPEBG@Z
??0MULTISZA@@QEAA@XZ
??0STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
??0LANG_STRING@@QEAA@XZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
?Copy@STRA@@QEAAJPEBDK@Z
??0STRA@@QEAA@PEADK@Z
?QueryStr@STRA@@QEAAPEADXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?SetLen@STRA@@QEAA_NK@Z
?QuerySize@BUFFER@@QEBAKXZ
?QueryCCH@STRA@@QEBAKXZ
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?QueryStr@STRA@@QEBAPEBDXZ
??0STRU@@QEAA@PEAGK@Z
??1STRU@@QEAA@XZ

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

Exports

Exports

RegisterModule

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35c9e74ceb4164a9c3a4fba110273b83

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-debug-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

iisutil

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 512B - Virtual size: 192B

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 512B - Virtual size: 192B