libcurl[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

libcurl.dll
Size

357KB
MD5

94f86810eb79615f97d72d8ad02898e1
SHA1

e7049e4f0d1e119401b38b9dcbf3ca9d6e4658f8
SHA256

3f8da5d739115b83063d1b10675a2c0d3ed0e9df1f3a919da35915351c437c12
SHA512

42ed49c66b823bbd5115bdf5395dc79d70c6bcc7313fbc1ce08280a0a2b77bea6fbddddde79e32d5bbf2f2ab4b72d7d0a4eccfc3cb9f08f067ceace2527f19d8
SSDEEP

6144:O8I388llM52ef90EyNjVPS7ZOAGB+Glo+PpfC3c1Ch38lzqRj+h:lL8llA0EMVkUl/51Chwz84

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

libcurl.dll

resource
libcurl.dll

Files

libcurl.dll
.dll windows:6 windows x64 arch:x64

f3c24e32e27c5ad10b0808e86b422c7d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

WSAIoctl
__WSAFDIsSet
socket
setsockopt
getsockopt
getpeername
connect
recv
closesocket
WSACleanup
WSAStartup
ntohs
listen
htons
getsockname
bind
accept
WSAGetLastError
send
select
recvfrom
sendto
getaddrinfo
freeaddrinfo
ioctlsocket
gethostname
htonl
ntohl
WSASetLastError

wldap32

ord41
ord50
ord22
ord211
ord46
ord143
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord60

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom

normaliz

IdnToAscii

crypt32

CertFreeCertificateContext

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerifyVersionInfoA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
GetCurrentProcess
WaitForSingleObjectEx
CloseHandle
Sleep
FormatMessageA
SetLastError
SleepEx
GetProcAddress
FreeLibrary
WaitForMultipleObjects
PeekNamedPipe
GetLastError
ReadFile
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
GetTickCount64
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
EnterCriticalSection
TerminateProcess

vcruntime140

strrchr
memcpy
memmove
memchr
strstr
memset
memcmp
__C_specific_handler
__std_type_info_destroy_list
strchr

api-ms-win-crt-string-l1-1-0

isdigit
strncpy
isalpha
isxdigit
tolower
strpbrk
isgraph
isprint
_strdup
isalnum
islower
isupper
strncmp
isspace

api-ms-win-crt-convert-l1-1-0

strtoll
strtol
strtoul
atoi

api-ms-win-crt-stdio-l1-1-0

fseek
__stdio_common_vsprintf
fputc
_lseeki64
_write
_read
_open
_close
__stdio_common_vsscanf
fflush
__acrt_iob_func
fclose
fwrite
feof
ferror
fputs
fgets
fread
fopen

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_stat64

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-heap-l1-1-0

calloc
free
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initterm
_initialize_narrow_environment
_getpid
_beginthreadex
_initialize_onexit_table
_execute_onexit_table
__sys_nerr
strerror
_errno
_cexit
_initterm_e

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 266KB - Virtual size: 266KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3c24e32e27c5ad10b0808e86b422c7d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

advapi32

normaliz

crypt32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 266KB - Virtual size: 266KB

.rdata Size: 72KB - Virtual size: 71KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1020B

.text
Size: 266KB - Virtual size: 266KB

.rdata
Size: 72KB - Virtual size: 71KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1020B