dll[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dll.dll
Size

6.9MB
MD5

bfb178dc0742c3755e18b4916ff8d34a
SHA1

3ba1f4428b6cf9e2945b556995b00ee1ea4dae07
SHA256

56970e2e20a813d540cc952299aba295670b3e948640d6b87c8bf6af7ae54ace
SHA512

39d3ced9e2bfec2d1f0a2d886dbd4d6da5fc527754448a8b3b8185409cfb3e93ae15ec1a35e8d299049dc1b3255f6b3019c0fe1749a971a4ac0d108bc9552b22
SSDEEP

98304:+W3ik5pRSPU7x9Rt/aq9ou6DjgLtNDGPFe/sXJFQMhCmnyvTpOcJF7sq6l:/bpUX66f8tNSPFOGJFQMhC7rwQa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dll.dll

Files

dll.dll
.dll windows:6 windows x86 arch:x86

8ff077d1cfbd3e14868875a55f5c3d9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\777\dll\cheat.pdb

Imports

ws2_32

WSACleanup
closesocket
getaddrinfo
WSAStartup
WSAGetLastError
socket
connect
recv
freeaddrinfo
send

kernel32

FormatMessageA
LocalFree
GetLocaleInfoEx
VirtualProtect
GetTickCount64
GetWindowsDirectoryA
WriteProcessMemory
GetCurrentProcess
GetModuleHandleA
Sleep
K32GetModuleInformation
CreateThread
Beep
GetProcAddress
WideCharToMultiByte
CreateDirectoryA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
GetEnvironmentVariableA
GetModuleFileNameA
IsDebuggerPresent
FindFirstFileExW
FindNextFileW
AreFileApisANSI
CloseHandle
GetModuleHandleW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
FreeLibrary
DeleteCriticalSection
SetEvent
IsProcessorFeaturePresent
CreateEventW
WaitForSingleObjectEx
SetUnhandledExceptionFilter
GetCurrentProcessId
LoadLibraryExA
FlushInstructionCache
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
ResetEvent
UnhandledExceptionFilter

user32

GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
ReleaseCapture
SetCapture
GetCapture
GetCursorPos
SetClipboardData
SetCursorPos
GetClientRect
CallWindowProcA
SetCursor
GetForegroundWindow
IsChild
ScreenToClient
MessageBoxA
ClientToScreen
GetKeyState
LoadCursorA
GetAsyncKeyState

shell32

ShellExecuteA

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?bad@ios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?fail@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
_Strxfrm
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

d3dx9_43

D3DXCreateTextureFromFileA
D3DXCreateTextureFromFileInMemory
D3DXMatrixTranslation

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

xinput1_3

ord2
ord4

vcruntime140

__std_exception_destroy
strstr
__std_exception_copy
_purecall
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
__current_exception_context
__CxxFrameHandler3
_setjmp3
longjmp
memchr
strrchr
memcpy
memcmp
memset
memmove
__current_exception
strchr

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_callnewh
free

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_invalid_parameter_noinfo_noreturn
system
abort
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
exit
_errno
_initialize_narrow_environment
strerror
terminate
_initterm
_seh_filter_dll
_configure_narrow_argv

api-ms-win-crt-math-l1-1-0

ldexp
_libm_sse2_pow_precise
fminf
fmaxf
llround
_libm_sse2_tan_precise
roundf
ceil
_dclass
_fdclass
_libm_sse2_sqrt_precise
_dsign
_libm_sse2_sin_precise
_libm_sse2_log_precise
frexp
floor
_CIatan2
_CIfmod
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_atan_precise

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort

api-ms-win-crt-stdio-l1-1-0

fgets
tmpfile
_popen
_pclose
_ftelli64
clearerr
fputc
fflush
feof
fclose
_wfopen
fgetc
__stdio_common_vsscanf
ferror
freopen
fwrite
getc
__stdio_common_vsprintf
__stdio_common_vfprintf
tmpnam
fgetpos
setvbuf
fseek
__acrt_iob_func
ftell
ungetc
fsetpos
fread
__stdio_common_vsprintf_s
_fseeki64
_get_stream_buffer_pointers
fopen

api-ms-win-crt-convert-l1-1-0

strtoull
atof
strtol
strtoll
atoi
strtod
strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
rename
remove
_lock_file

api-ms-win-crt-string-l1-1-0

tolower
strspn
isblank
strncmp
isalnum
isspace
iswalpha
strncpy
isalpha
strcpy_s
towlower
isupper
islower
isdigit
isxdigit
ispunct
isgraph
iscntrl
strpbrk
toupper
strcoll

api-ms-win-crt-time-l1-1-0

_time64
_localtime64
clock
_difftime64
_gmtime64
_mktime64
strftime

api-ms-win-crt-locale-l1-1-0

localeconv
setlocale
___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.2MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ff077d1cfbd3e14868875a55f5c3d9d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

shell32

msvcp140

d3dx9_43

imm32

xinput1_3

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 295KB - Virtual size: 295KB

.data Size: 4.2MB - Virtual size: 7.8MB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 98KB - Virtual size: 98KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 295KB - Virtual size: 295KB

.data
Size: 4.2MB - Virtual size: 7.8MB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 98KB - Virtual size: 98KB