elshyph[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

elshyph.dll
Size

115KB
MD5

2737286c029f612aef3a20fc83351d65
SHA1

eff71cf1348b3f8b6dcdb9cfafab734a092d6be4
SHA256

5567558acf8ebf8ae7199f31b6ae801e18143ce6a3f4ea5c1776504cdbc6e3b1
SHA512

6cbbfe2a05362af348e5be1fdf6e1a984d86a3bf3ddbb4b7c99d447a8fe087b82d927ac07864ccb72e827078c17ed641a0440b9d16ffbbe5728624e99dfe8e87
SSDEEP

3072:Rnyc68wJMwhZDMaY+nBuqfFUmNXyzgsJJds:p9EXZxfF7NXy8CJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
elshyph.dll

Files

elshyph.dll
.dll windows:10 windows x86 arch:x86

47001b3ba0d9aa170c5f35fafd57b216

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

elshyph.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
_onexit
free
realloc
malloc
_purecall
??_V@YAXPAX@Z
_except_handler4_common
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
??3@YAXPAX@Z
__CxxFrameHandler3
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memmove
memcmp
memcpy
memset

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
AcquireSRWLockExclusive
GetSystemWindowsDirectoryW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
MapViewOfFile
UnmapViewOfFile
CloseHandle
CreateFileW
GetLastError
LocalFree
CreateFileMappingW
CompareStringOrdinal

advapi32

EventRegister
EventUnregister
EventWriteTransfer

shlwapi

PathAppendW

bcp47langs

GetClosestMatchingUserLanguage

Exports

Exports

DoAction
FreePropertyBag
FreeService
InitService
RecognizeText

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47001b3ba0d9aa170c5f35fafd57b216

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

shlwapi

bcp47langs

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 93KB

.data Size: 7KB - Virtual size: 7KB

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 94KB - Virtual size: 93KB

.data
Size: 7KB - Virtual size: 7KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB