libcurl[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

libcurl.dll
Size

284KB
MD5

0f7b13cf3548623e105d176e90d00d22
SHA1

edf6e58426a2c3e89f3735ef40031964683a30a5
SHA256

fd1a9a0a38ccbe9cfbc7bbd329d8234e9455163bbc2dd52d98b2f5cf0e970462
SHA512

385f42b704b988a37a0af14bd426716fa730cc2d034228bb39d859a8f6ed4decace48415e430375898681ad48ec61532b1b653883d82c6a3eeaab954114d1343
SSDEEP

6144:tvm5F3eJvPhmZfjmfvrKvBKmbOp3Co2xG5OYeUkGARChrCp:tvm5FMPOCcC3ComG4wyUi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libcurl.dll

Files

libcurl.dll
.dll windows:4 windows x86 arch:x86

0d10843c483683afd564fc755433579c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wldap32

ord46
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord60
ord143
ord211
ord22
ord41

ws2_32

gethostbyname
inet_addr
WSASetLastError
connect
socket
closesocket
recv
inet_ntoa
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
WSAGetLastError
htonl
getservbyname
gethostbyaddr
getservbyport
gethostname
WSACleanup
WSAStartup
accept
listen
ioctlsocket
__WSAFDIsSet
select
send
sendto
recvfrom
getpeername

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetModuleHandleA
GetVersionExA
FormatMessageA
Sleep
ExpandEnvironmentStringsA
WaitForSingleObject
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SleepEx
GetLastError
SetLastError
EnterCriticalSection
DisableThreadLibraryCalls
LeaveCriticalSection
GetSystemTimeAsFileTime
InitializeCriticalSection
DeleteCriticalSection

advapi32

CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptImportKey
CryptReleaseContext
CryptEncrypt
CryptDestroyKey
CryptCreateHash

msvcr80

getenv
strstr
strncpy
tolower
memchr
fputc
fflush
fwrite
_getpid
strerror
__sys_nerr
strpbrk
atoi
fseek
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
sprintf
_strdup
_close
_open
_read
_gmtime64
_time64
memset
_errno
strncmp
memcpy
_write
strchr
memmove
strrchr
_strtoi64
sscanf
fgets
fclose
fputs
fopen
__iob_func
qsort
strcpy_s
calloc
free
strncpy_s
strtoul
sprintf_s
strcat_s
islower
isalpha
isupper
isdigit
isprint
isalnum
isgraph
isspace
isxdigit
toupper
_beginthreadex
realloc
malloc
_fstat64
_lseeki64
_stat64
fread
ferror
feof
strtol

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d10843c483683afd564fc755433579c

Headers

File Characteristics

Imports

wldap32

ws2_32

kernel32

advapi32

msvcr80

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 40KB - Virtual size: 37KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 9KB