dirlist[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dirlist.dll
Size

23KB
MD5

e6e02a02b98be10d66f3d5bbf60f1379
SHA1

927f1568a8fd9e1ea78a8bb152d645bd9d577c44
SHA256

df174f71a45b70f85487734275e0f09be8908a5a10e5352e042e317deb5fc859
SHA512

338963455c58393bb5523ecb26fa3ddf89081446bd07dd7ad4ae2d070866370d53d0c280d1b686bf2e0ebd4115240681e710409a6666a5b3d14234ec0edf9152
SSDEEP

384:UIBdZ8Abbg6/mplqu2H+YM2WQWmlgFeoFa/XbC+fyWwq:UiVo6/m3quVlW07WXbC+8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dirlist.dll

Files

dirlist.dll
.dll windows:10 windows x64 arch:x64

fbb6f2b3ea6b39d5d8afba1c0a59d849

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dirlist.pdb

Imports

msvcrt

_i64toa
_wcsicmp
qsort
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memmove
memset

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
DebugBreak

api-ms-win-core-file-l1-2-1

FindNextFileW
FindClose
FindFirstFileW
FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
SetThreadToken

api-ms-win-security-base-l1-2-0

RevertToSelf

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

iisutil

?Terminate@LANG_STRING@@QEAAJXZ
?Initialize@LANG_STRING@@QEAAJPEAUHINSTANCE__@@K@Z
??0LANG_STRING@@QEAA@XZ
?Resize@BUFFER@@QEAA_NKK@Z
?Resize@BUFFER@@QEAA_NK@Z
??1STRU@@QEAA@XZ
?AppendW@STRA@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBGK@Z
?Append@STRU@@QEAAJPEBG@Z
?Append@STRA@@QEAAJPEBDK@Z
?Copy@STRU@@QEAAJPEBG@Z
?GetString@LANG_STRING@@QEAAJIPEBDPEAPEBGPEAK@Z
?CopyA@STRU@@QEAAJPEBD@Z
?GetLanguage@LANG_STRING@@QEAAJPEBDKPEAPEBDHH@Z
??0STRA@@QEAA@XZ
??1STRA@@QEAA@XZ
??0STRA@@QEAA@PEADK@Z
??1BUFFER@@QEAA@XZ
?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z
?Append@STRA@@QEAAJAEBV1@@Z
?Copy@STRA@@QEAAJPEBD@Z
?Append@STRA@@QEAAJPEBD@Z
?CopyWToUTF8Escaped@STRA@@QEAAJPEBG@Z
?HTMLEncode@STRA@@QEAAJXZ
??0STRU@@QEAA@PEAGK@Z
??0BUFFER@@QEAA@XZ
??0STRU@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbb6f2b3ea6b39d5d8afba1c0a59d849

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-debug-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

iisutil

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 792B

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 512B - Virtual size: 160B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 792B

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 512B - Virtual size: 160B