VAN[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

VAN.dll
Size

456KB
MD5

88e73a92b39450b079fa3bcf02b9f88e
SHA1

648fbc2f0a4d94944595f7f9a31b209394179b35
SHA256

8276a519278504b8c6f83bfe8b34e47e22d5074b0178b890f78c78fbbd48c590
SHA512

5b92320a6bd6dc4f4d69029276290c969095abd0f7c0a94e29b5431b9ef310ac654459f14f43839bf37489904aa2f5ccad9f8019d847827b63747343073545fd
SSDEEP

6144:bmWZRek6GFC5HNyiLdXOw488fxmInARbPaJSkOYl2TCVjnbC9HwAyec:bmWZR1XgWw48YFCSJSkORCdb+yec

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VAN.dll

Files

VAN.dll
.dll regsvr32 windows:10 windows x86 arch:x86

e7846dd8b6891b26a6675252b4eed42f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

van.pdb

Imports

msvcrt

_vsnprintf_s
_callnewh
iswprint
wcscat_s
wcscpy_s
_wcsicmp
towlower
iswspace
memmove_s
_errno
realloc
?terminate@@YAXXZ
_lock
_onexit
??1type_info@@UAE@XZ
wcsstr
_wtol
memcmp
floor
_vsnwprintf
_ftol2_sse
_ftol2
_CIpow
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
wcsncpy_s
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
??3@YAXPAX@Z
malloc
free
_purecall
_XcptFilter
_amsg_exit
_initterm
__dllonexit
_except_handler4_common
memcpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
_unlock
memset

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlGUIDFromString
RtlInitUnicodeString
WinSqmAddToAverageDWORD
WinSqmIsOptedIn
RtlPublishWnfStateData
WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmAddToStreamEx
RtlNtStatusToDosError

oleaut32

UnRegisterTypeLi
RegisterTypeLi
SysStringLen
SysFreeString
SafeArrayCreateVector
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
LoadTypeLi
VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadStringW
GetModuleHandleExW
LockResource
SizeofResource
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadResource
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
ReleaseSemaphore
InitializeCriticalSection
CreateEventW
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
CreateMutexExW
ResetEvent
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoMarshalInterThreadInterfaceInStream
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoSetProxyBlanket
IIDFromString
StringFromCLSID
CoUninitialize
CoInitializeEx
CLSIDFromString
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoFreeUnusedLibrariesEx

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegNotifyChangeKeyValue
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
ProcessIdToSessionId
CreateThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-localization-l1-2-0

SetThreadLocale
FormatMessageW
GetThreadLocale

iphlpapi

ConvertInterfaceLuidToAlias
ConvertInterfaceGuidToLuid

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
ActivateActCtx
ReleaseActCtx
DeactivateActCtx

user32

SystemParametersInfoA
RegisterWindowMessageW
LoadImageW
KillTimer
SetTimer
IsWindow
NotifyWinEvent
GetDC
GetWindowRect
MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage
PeekMessageW
ReleaseDC
GetWindowDC
GetSysColor
SystemParametersInfoW
SendMessageW
GetKeyState
PostMessageW
SetFocus
SetForegroundWindow
SetActiveWindow
SetWindowLongW
GetWindowLongW
DestroyIcon
GetParent
SetPropW
FindWindowW
AllowSetForegroundWindow
EnumChildWindows
IsWindowVisible
GetPropW
UnregisterClassA

gdi32

DeleteObject
GetDeviceCaps

shell32

SHCreateItemInKnownFolder
ShellExecuteExW
SHGetIDListFromObject

shcore

IUnknown_Set
GetScaleFactorForDevice
ord223
ord232
ord233
ord230
ord162

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
HideVAN
RunVANW
ShowVAN
ShutdownVAN
VanUIManager_CreateInstance

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7846dd8b6891b26a6675252b4eed42f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-0

iphlpapi

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

user32

gdi32

shell32

shcore

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 207KB - Virtual size: 207KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 1024B - Virtual size: 952B

.rsrc Size: 220KB - Virtual size: 220KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 207KB - Virtual size: 207KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 1024B - Virtual size: 952B

.rsrc
Size: 220KB - Virtual size: 220KB

.reloc
Size: 16KB - Virtual size: 16KB