Overview

overview

10

Static

static

10

38c381e1f0...37.dll

windows7-x64

1

38c381e1f0...37.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637.dll

  • Size

    8.4MB

  • MD5

    613c4362904eff8d7c3c52e762d755d8

  • SHA1

    15f4139a67d71567facda192399c8b933bf7e4bf

  • SHA256

    38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637

  • SHA512

    dc61ecc0e18d63b8772cf93e4bc8c32f8ce8b8639afec21f8e9b09f98370c76740ba35ae5c4d984510bb1c72fa882d21aed336a0b7d87a6889fbbaba10f08f7b

  • SSDEEP

    196608:NVw7qVycDcqSCl1DbgLrFYDPeOUNLQCGP9lcclsYkL:bw7UKqSCl1DbgLrFYDPeOUNLQCGP9lc1

Score
10/10

Malware Config

Signatures

  • Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 1 IoCs
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Detects executables built or packed with MPress PE compressor 1 IoCs
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Detects executables packed with RLPACK 1 IoCs
  • Detects executables packed with VMProtect. 1 IoCs
  • Detects executables potentially checking for WinJail sandbox window 1 IoCs
  • Detects executables referencing many IR and analysis tools 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections