libfmt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

libfmt.dll
Size

271KB
MD5

fc1a3f5974aa14cb4573bd44bfcc7877
SHA1

5dc66e9a4e70ea44dd41bd0750d4679915b48817
SHA256

0ae90799faf7682a7d808df6e03c71390728b67283840446970a4ed5c251df76
SHA512

c5d8ba5d583a949af0c51b4b9eff0ec33ab9e43415317545bfdcfc9ada81e0ef3f647252e08b1c5c00c0742b22328263b797c9141e3d6dc32011281e067375c6
SSDEEP

6144:Ajt9tErHbfdPj6SdpO9BcBLughLMHxJGSMHZAc8olHFy/6nxneaBrk8UVyOy/Bzj:AjdQdPmSdpO9BckgheQAilHFy/s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libfmt.dll

Files

libfmt.dll
.dll windows:4 windows x86 arch:x86

fdb71977ca1a3dd2575c4f3a3749270f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libgcc_s_dw2-1

_Unwind_Resume
__deregister_frame_info
__register_frame_info
__udivdi3
__umoddi3

kernel32

DeleteCriticalSection
EnterCriticalSection
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteConsoleW

msvcrt

___mb_cur_max_func
_amsg_exit
_close
_dup
_dup2
_errno
_fdopen
_fileno
_get_osfhandle
_initterm
_iob
_isatty
_lock
_open
_pipe
_read
_unlock
_write
abort
atoi
calloc
fclose
fopen
fputc
free
fwrite
getenv
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setlocale
strchr
strerror
strlen
strncmp
vfprintf
wcslen

libstdc++-6

_ZNKSt13runtime_error4whatEv
_ZNKSt3_V214error_category10_M_messageB5cxx11Ei
_ZNKSt3_V214error_category10equivalentERKSt10error_codei
_ZNKSt3_V214error_category10equivalentEiRKSt15error_condition
_ZNKSt3_V214error_category23default_error_conditionEi
_ZNKSt6locale2id5_M_idEv
_ZNSt12system_errorD1Ev
_ZNSt13runtime_errorC1EPKc
_ZNSt13runtime_errorC2EPKc
_ZNSt13runtime_errorC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNSt13runtime_errorD1Ev
_ZNSt13runtime_errorD2Ev
_ZNSt3_V214error_categoryD2Ev
_ZNSt3_V216generic_categoryEv
_ZNSt6locale5facetD2Ev
_ZNSt6localeC1ERKS_
_ZNSt6localeC1Ev
_ZNSt6localeD1Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEjjPKcj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEjc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE14_M_replace_auxEjjjc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERjj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_
_ZSt16__throw_bad_castv
_ZSt17__throw_bad_allocv
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt9terminatev
_ZSt9use_facetINSt7__cxx118numpunctIcEEERKT_RKSt6locale
_ZSt9use_facetINSt7__cxx118numpunctIwEEERKT_RKSt6locale
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZTVSt12system_error
_ZdaPv
_ZdlPv
_ZdlPvj
_Znaj
_Znwj
__cxa_allocate_exception
__cxa_bad_cast
__cxa_begin_catch
__cxa_end_catch
__cxa_free_exception
__cxa_guard_acquire
__cxa_guard_release
__cxa_throw
__dynamic_cast
__gxx_personality_v0

Exports

Exports

_ZN3fmt3v1012format_facetISt6localeE2idE
_ZN3fmt3v1013buffered_file5closeEv
_ZN3fmt3v1013buffered_fileC1ENS0_18basic_cstring_viewIcEES3_
_ZN3fmt3v1013buffered_fileC2ENS0_18basic_cstring_viewIcEES3_
_ZN3fmt3v1013buffered_fileD1Ev
_ZN3fmt3v1013buffered_fileD2Ev
_ZN3fmt3v1013vsystem_errorEiNS0_17basic_string_viewIcEENS0_17basic_format_argsINS0_20basic_format_contextINS0_8appenderEcEEEE
_ZN3fmt3v1014vwindows_errorEiNS0_17basic_string_viewIcEENS0_17basic_format_argsINS0_20basic_format_contextINS0_8appenderEcEEEE
_ZN3fmt3v1015system_categoryEv
_ZN3fmt3v1019format_system_errorERNS0_6detail6bufferIcEEiPKc
_ZN3fmt3v1019report_system_errorEiPKc
_ZN3fmt3v1020report_windows_errorEiPKc
_ZN3fmt3v104file3dupEi
_ZN3fmt3v104file4dup2Ei
_ZN3fmt3v104file4dup2EiRSt10error_code
_ZN3fmt3v104file4pipeERS1_S2_
_ZN3fmt3v104file4readEPvj
_ZN3fmt3v104file5closeEv
_ZN3fmt3v104file5writeEPKvj
_ZN3fmt3v104file6fdopenEPKc
_ZN3fmt3v104fileC1ENS0_18basic_cstring_viewIcEEi
_ZN3fmt3v104fileC2ENS0_18basic_cstring_viewIcEEi
_ZN3fmt3v104fileD1Ev
_ZN3fmt3v104fileD2Ev
_ZN3fmt3v106detail10locale_refC1ISt6localeEERKT_
_ZN3fmt3v106detail10locale_refC2ISt6localeEERKT_
_ZN3fmt3v106detail10vformat_toIcEEvRNS1_6bufferIT_EENS0_17basic_string_viewIS4_EENS1_12vformat_argsIS4_E4typeENS1_10locale_refE
_ZN3fmt3v106detail11assert_failEPKciS3_
_ZN3fmt3v106detail11file_buffer4growEj
_ZN3fmt3v106detail11file_bufferC1ENS0_18basic_cstring_viewIcEERKNS1_14ostream_paramsE
_ZN3fmt3v106detail11file_bufferC1EOS2_
_ZN3fmt3v106detail11file_bufferC2ENS0_18basic_cstring_viewIcEERKNS1_14ostream_paramsE
_ZN3fmt3v106detail11file_bufferC2EOS2_
_ZN3fmt3v106detail11file_bufferD1Ev
_ZN3fmt3v106detail11file_bufferD2Ev
_ZN3fmt3v106detail12is_printableEj
_ZN3fmt3v106detail12report_errorEPFvRNS1_6bufferIcEEiPKcEiS6_
_ZN3fmt3v106detail13utf8_to_utf16C1ENS0_17basic_string_viewIcEE
_ZN3fmt3v106detail13utf8_to_utf16C2ENS0_17basic_string_viewIcEE
_ZN3fmt3v106detail13write_consoleEP6_iobufNS0_17basic_string_viewIcEE
_ZN3fmt3v106detail15vprint_mojibakeEP6_iobufNS0_17basic_string_viewIcEENS0_17basic_format_argsINS0_20basic_format_contextINS0_8appenderEcEEEE
_ZN3fmt3v106detail17format_error_codeERNS1_6bufferIcEEiNS0_17basic_string_viewIcEE
_ZN3fmt3v106detail18decimal_point_implIcEET_NS1_10locale_refE
_ZN3fmt3v106detail18decimal_point_implIwEET_NS1_10locale_refE
_ZN3fmt3v106detail18thousands_sep_implIcEENS1_20thousands_sep_resultIT_EENS1_10locale_refE
_ZN3fmt3v106detail18thousands_sep_implIwEENS1_20thousands_sep_resultIT_EENS1_10locale_refE
_ZN3fmt3v106detail18throw_format_errorEPKc
_ZN3fmt3v106detail20format_windows_errorERNS1_6bufferIcEEiPKc
_ZN3fmt3v106detail5printEP6_iobufNS0_17basic_string_viewIcEE
_ZN3fmt3v106detail6bufferIcE6appendIcEEvPKT_S7_
_ZN3fmt3v106detail6bufferIwE6appendIwEEvPKT_S7_
_ZN3fmt3v106detail9dragonbox10to_decimalIdEENS2_10decimal_fpIT_EES5_
_ZN3fmt3v106detail9dragonbox10to_decimalIfEENS2_10decimal_fpIT_EES5_
_ZN3fmt3v106detail9dragonbox16get_cached_powerEi
_ZN3fmt3v106detail9write_locENS0_8appenderENS0_9loc_valueERKNS0_12format_specsIcEENS1_10locale_refE
_ZN3fmt3v106vprintENS0_17basic_string_viewIcEENS0_17basic_format_argsINS0_20basic_format_contextINS0_8appenderEcEEEE
_ZN3fmt3v106vprintEP6_iobufNS0_17basic_string_viewIcEENS0_17basic_format_argsINS0_20basic_format_contextINS0_8appenderEcEEEE
_ZN3fmt3v107ostreamD1Ev
_ZN3fmt3v107ostreamD2Ev
_ZN3fmt3v107vformatB5cxx11ENS0_17basic_string_viewIcEENS0_17basic_format_argsINS0_20basic_format_contextINS0_8appenderEcEEEE
_ZNK3fmt3v1012format_facetISt6localeE6do_putENS0_8appenderENS0_9loc_valueERKNS0_12format_specsIcEE
_ZNK3fmt3v1013buffered_file10descriptorEv
_ZNK3fmt3v104file4sizeEv
_ZNK3fmt3v106detail10locale_ref3getISt6localeEET_v

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 512B - Virtual size: 307B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 1024B - Virtual size: 553B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 512B - Virtual size: 155B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fdb71977ca1a3dd2575c4f3a3749270f

Headers

File Characteristics

Imports

libgcc_s_dw2-1

kernel32

msvcrt

libstdc++-6

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 120KB

.data Size: 512B - Virtual size: 116B

.rdata Size: 9KB - Virtual size: 8KB

/4 Size: 19KB - Virtual size: 18KB

.bss Size: - Virtual size: 3KB

.edata Size: 4KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 3KB

/14 Size: 512B - Virtual size: 56B

/29 Size: 7KB - Virtual size: 7KB

/41 Size: 512B - Virtual size: 307B

/55 Size: 1024B - Virtual size: 553B

/67 Size: 512B - Virtual size: 56B

/80 Size: 512B - Virtual size: 155B

.text
Size: 121KB - Virtual size: 120KB

.data
Size: 512B - Virtual size: 116B

.rdata
Size: 9KB - Virtual size: 8KB

/4
Size: 19KB - Virtual size: 18KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 4KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 3KB

/14
Size: 512B - Virtual size: 56B

/29
Size: 7KB - Virtual size: 7KB

/41
Size: 512B - Virtual size: 307B

/55
Size: 1024B - Virtual size: 553B

/67
Size: 512B - Virtual size: 56B

/80
Size: 512B - Virtual size: 155B