libopenslide-0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libopenslide-0.dll
Size

9.0MB
MD5

09c81e6e5b259f18a9d41ac7aebf3aa7
SHA1

8d36b34e46292d7cb251fd43f744f86d1b61115d
SHA256

ad0015ba5780eedbb0733f40da80a5b422862474031ee276b16903411d0072cd
SHA512

da517edbbd2732ac9a9ed0ad602b7df8e1e3a9a3ee18c2457c7c7b3322270fa9dbc66c8dbf7715041d0ee1be96bc99cdad464a316c88a13e19c1e4cf22d6a889
SSDEEP

196608:He466elBNuzZUNE9cdCkD96M4t1yhSrkCwPBNMnme5qyXTkA:dWN+Znrvx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libopenslide-0.dll

Files

libopenslide-0.dll
.dll windows:4 windows x86 arch:x86

5659474c17bcab1bc2e32320b6c4f666

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

ConvertSidToStringSidA
CopySid
GetCurrentHwProfileA
GetFileSecurityW
GetLengthSid
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetTokenInformation
GetUserNameW
IsValidSid
LookupAccountSidW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegLoadMUIStringW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

dnsapi

DnsFree
DnsQuery_A

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
ExtCreateRegion
ExtSelectClipRgn
ExtTextOutW
GdiFlush
GetCharWidth32A
GetClipBox
GetClipRgn
GetDeviceCaps
GetFontData
GetFontUnicodeRanges
GetGlyphIndicesW
GetGlyphOutlineW
GetGraphicsMode
GetObjectW
GetOutlineTextMetricsA
GetTextMetricsA
GetWorldTransform
IntersectClipRect
ModifyWorldTransform
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SetBkMode
SetGraphicsMode
SetMapMode
SetTextAlign
SetTextColor
SetWorldTransform
StretchDIBits

iphlpapi

CancelMibChangeNotify2
GetAdaptersAddresses
GetIpForwardTable2
NotifyRouteChange2
if_nametoindex

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AllocConsole
AreFileApisANSI
AttachConsole
CancelIo
CloseHandle
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DebugBreak
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitThread
ExpandEnvironmentStringsW
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineW
GetComputerNameW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetShortPathNameW
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemWow64DirectoryW
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadLocale
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVolumeInformationW
GetVolumePathNameW
GetWindowsDirectoryW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
Module32First
Module32Next
MoveFileExW
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekConsoleInputA
PeekNamedPipe
QueryMemoryResourceNotification
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleInputA
ReadDirectoryChangesW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleMode
SetConsoleTitleW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetThreadErrorMode
SetThreadPriority
Sleep
SleepConditionVariableSRW
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
WriteFile

msvcrt

__mb_cur_max
__setusermatherr
_aligned_free
_aligned_malloc
_aligned_realloc
_amsg_exit
_assert
_beginthreadex
_chdir
_dup2
_endthreadex
_errno
_chsize
_close
_commit
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_fstat64
_fstati64
_get_osfhandle
_getch
_getdrive
_hypot
_initterm
_iob
_isatty
_kbhit
_lock
_lseeki64
_open_osfhandle
_pipe
_setjmp3
_snprintf
_snwprintf
_snwprintf_s
_stati64
_strdup
_stricmp
_strnicmp
_ui64toa_s
_unlock
_vsnprintf
_waccess
_wchdir
_wchmod
_wcreat
_wcsicmp
_wcsnicmp
_wfopen
_wfreopen
_wfullpath
_wmkdir
_wopen
_wputenv
_wremove
_wrmdir
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wunlink
abort
acos
atof
atoi
atol
bsearch
calloc
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgetwc
fopen
fputc
fputs
fread
free
freopen
fseek
fsetpos
fwrite
getc
getenv
islower
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
log10
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
mktime
localtime
gmtime
qsort
raise
rand
realloc
remove
rewind
setlocale
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strncpy_s
strpbrk
strrchr
strspn
strstr
strtol
strtoul
swprintf_s
tan
tolower
toupper
towlower
ungetc
ungetwc
vfprintf
time
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsrchr
wcsspn
wcstol
wcstombs
wcstoul
wctomb
_wutime
_wstat
_wfindnext
_wfindfirst
_stat
longjmp
_write
_wcsicmp
_wcsdup
_stricmp
_strdup
_read
_open
_getpid
_getcwd
_fileno
_fdopen
_dup
_close

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize

libwinpthread-1

pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_wait
pthread_equal
pthread_getspecific
pthread_key_create
pthread_key_delete
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_once
pthread_self
pthread_setspecific

shell32

CommandLineToArgvW
SHBindToParent
SHCreateShellItemArrayFromIDLists
SHFileOperationW
SHGetDesktopFolder
SHGetKnownFolderPath
SHParseDisplayName

shlwapi

SHLoadIndirectString
StrRetToStrW

user32

DispatchMessageA
FillRect
GetDC
GetMessageA
IsWindow
MessageBoxW
MsgWaitForMultipleObjectsEx
PeekMessageA
PostMessageA
PostQuitMessage
ReleaseDC
SystemParametersInfoA
TranslateMessage

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSADuplicateSocketA
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASetEvent
WSASetLastError
WSASocketA
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

libssp-0

__chk_fail
__strcat_chk
__strcpy_chk

Exports

Exports

openslide_can_open
openslide_cancel_prefetch_hint
openslide_close
openslide_detect_vendor
openslide_get_associated_image_dimensions
openslide_get_associated_image_names
openslide_get_best_layer_for_downsample
openslide_get_best_level_for_downsample
openslide_get_comment
openslide_get_error
openslide_get_layer0_dimensions
openslide_get_layer_count
openslide_get_layer_dimensions
openslide_get_layer_downsample
openslide_get_level0_dimensions
openslide_get_level_count
openslide_get_level_dimensions
openslide_get_level_downsample
openslide_get_property_names
openslide_get_property_value
openslide_get_version
openslide_give_prefetch_hint
openslide_open
openslide_read_associated_image
openslide_read_region

Sections

.text
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 919KB - Virtual size: 919KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 1018B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5659474c17bcab1bc2e32320b6c4f666

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dnsapi

gdi32

iphlpapi

kernel32

msvcrt

ole32

libwinpthread-1

shell32

shlwapi

user32

ws2_32

libssp-0

Exports

Exports

Sections

.text Size: 6.3MB - Virtual size: 6.3MB

.data Size: 12KB - Virtual size: 11KB

.rdata Size: 1.6MB - Virtual size: 1.6MB

/4 Size: 919KB - Virtual size: 919KB

.bss Size: - Virtual size: 17KB

.edata Size: 1024B - Virtual size: 1018B

.idata Size: 15KB - Virtual size: 14KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 206KB - Virtual size: 205KB

/14 Size: 512B - Virtual size: 32B

.text
Size: 6.3MB - Virtual size: 6.3MB

.data
Size: 12KB - Virtual size: 11KB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

/4
Size: 919KB - Virtual size: 919KB

.bss
Size: - Virtual size: 17KB

.edata
Size: 1024B - Virtual size: 1018B

.idata
Size: 15KB - Virtual size: 14KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 206KB - Virtual size: 205KB

/14
Size: 512B - Virtual size: 32B