SysLab[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SysLab.dll
Size

615KB
MD5

afba34352f9b09d9e37c77edef408d87
SHA1

1adeef19985f83acc84cb69872146320cb0474b5
SHA256

7aba0201e67c4c4e61c10963e354bad3ac2b721d0a77fd3c822b788fee0d3772
SHA512

5ecc9f2abd4e1e0a2cdb1f8e1c88c97a9d240c9e20b16a4a12ec4fc1f4fc7bf439b97493b794eacc0536b0e1824a3cf979eb87198e229963aa6041d90b81a962
SSDEEP

12288:md+Ul2rpAe+7fa9BqpriR4luNAs106jdPIXs7on7VLMWZT8DuAQIZwqYoq+dUL0c:m6JKEcub

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SysLab.dll

Files

SysLab.dll
.dll windows:6 windows x64 arch:x64

ff61c2b4e30c88c565df7dea0e6b0417

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\AHUYAL\NewFormularMacOS\x64\Release\extern\SysLab.pdb

Imports

kernel32

GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

memcmp
memmove
__C_specific_handler
__std_type_info_destroy_list
__current_exception_context
strstr
_purecall
memset
__std_exception_copy
__current_exception
__std_exception_destroy
memcpy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_errno
terminate
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initterm
_cexit
_crt_at_quick_exit

api-ms-win-crt-string-l1-1-0

strlen
strcmp
strncmp
isxdigit
strncpy
strcat
_stricmp
strcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fclose
__stdio_common_vfscanf
_close
fflush
_open
__stdio_common_vsprintf
rewind

api-ms-win-crt-math-l1-1-0

ceil
floor
pow
log10
tanh
fmod
acos
_dtest
tan
sin
fabs
sqrt
_fdopen
log
atan
sinh
exp
cosh
cos
asin

api-ms-win-crt-utility-l1-1-0

rand
abs

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
atof
atol

api-ms-win-crt-time-l1-1-0

_time64
_mktime64
_localtime64
_difftime64
_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_umask_s
_stat64i32

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

Exports

Exports

NotifyDelICalcKernel
RegisterExternCalc

Sections

.text
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 121KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff61c2b4e30c88c565df7dea0e6b0417

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 368KB - Virtual size: 367KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 121KB - Virtual size: 125KB

.pdata Size: 16KB - Virtual size: 16KB

.idata Size: 7KB - Virtual size: 6KB

.00cfg Size: 512B - Virtual size: 337B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 368KB - Virtual size: 367KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 121KB - Virtual size: 125KB

.pdata
Size: 16KB - Virtual size: 16KB

.idata
Size: 7KB - Virtual size: 6KB

.00cfg
Size: 512B - Virtual size: 337B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 5KB