loghttp[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

loghttp.dll
Size

37KB
MD5

e2efcf91065d25a2f484951d0ec7a234
SHA1

017bda20e3bf4b73a74e60880942231ce15cfa10
SHA256

39c3c6140e08eea5f6b74d3fb03c8a9068868045fed8c894477114f44abf8ea4
SHA512

8fde1ee75139d01410ae62d27e63a52904a304c77bc0581b78b60e82286fb6e37ac30f825bca547480b07b4715a98f6ef5e0782daaf3062581e8bf1b234b0c48
SSDEEP

768:5buL2n2GteuMwJ6jAWe+5vriXggM5PjBr8W:JurGTccWe+5v+X45PeW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loghttp.dll

Files

loghttp.dll
.dll windows:10 windows x64 arch:x64

36fc39e511ca3626b39a76c7b45e480c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

loghttp.pdb

Imports

msvcrt

_ultow_s
_ultoa
_wcsicmp
_strtoui64
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
_onexit
wcsncpy_s
_strupr
_vsnprintf_s
__dllonexit
memcpy
memset

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringA

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExA

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
Sleep
DeleteCriticalSection
LeaveCriticalSection

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-2-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

iisutil

?Append@STRU@@QEAAJPEBGK@Z
?WriteMessage@IPM2_MESSAGE_PIPE@@QEAAJW4IPM2_OPCODE@@KKPEAXK1@Z
?Append@STRU@@QEAAJPEBG@Z
?WriteMessage@IPM2_MESSAGE_PIPE@@QEAAJW4IPM2_OPCODE@@KPEAX@Z
?Copy@STRU@@QEAAJPEBGK@Z
GetTokenUserSID
?Append@MULTISZ@@QEAAHPEBG@Z
?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QEAAXXZ
?Copy@STRU@@QEAAJPEBG@Z
?CopyW@STRA@@QEAAJPEBG@Z
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBG@Z
?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHHKPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@PEAH@Z
GenerateNameWithGUID
FreeTokenUserSID
?QueryCB@MULTISZ@@QEBAIXZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
??0EVENT_LOG@@QEAA@PEBG@Z
??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??1STRU@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
IISInitializeCriticalSection
PuDbgPrint
??1MULTISZ@@QEAA@XZ
?IsEmpty@STRA@@QEBA_NXZ
?QueryCCH@STRA@@QEBAKXZ
?QueryStr@STRA@@QEBAPEBDXZ
??0STRU@@QEAA@XZ
??0STRA@@QEAA@XZ
?Reset@MULTISZ@@QEAAXXZ
?QueryStr@MULTISZ@@QEBAPEAGXZ
??0MULTISZ@@QEAA@XZ
?QueryStr@STRU@@QEAAPEAGXZ
?Reset@STRA@@QEAAXXZ
?AppendW@STRA@@QEAAJPEBG@Z
?QueryCB@STRA@@QEBAKXZ
?Reset@STRU@@QEAAXXZ
?Append@STRU@@QEAAJG@Z
?AppendA@STRU@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0STRU@@QEAA@PEAGK@Z
?Copy@STRA@@QEAAJPEBDK@Z
?SyncWithBuffer@STRA@@QEAAXXZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36fc39e511ca3626b39a76c7b45e480c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-debug-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

iisutil

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 512B - Virtual size: 188B

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 512B - Virtual size: 188B