librtmp[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

librtmp.dll
Size

179KB
MD5

9a836696f6c5edbcb42f32e28cf4d28d
SHA1

32a08eeb76b0a5d24e891116ae3415404151bf34
SHA256

a50a8085753a6817b4e49f2efbb2fa96a66b8593e6bd8467e0aa33d96b9a9048
SHA512

30cd101a996d195ba9547d86c71faa0e569609aad356ce4475cc66f5b9d3a7086c345dd2d5392d1da89c783ddc4e7316bd7cf9b01088aad09110756c7a67f023
SSDEEP

3072:pNJfoGI0W1Mo0MnXDTHsnkG4ZGM6vW/GRE8/J6OFNcJ04TBfKE/ftbUq6NmP:1a0mX3snd4zERE8wOFN94TBS8ft2s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
librtmp.dll

Files

librtmp.dll
.dll windows:4 windows x86 arch:x86

6e971542efa5e49dfc92263b7078330b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
DeleteCriticalSection
EnterCriticalSection
FindAtomA
FreeLibrary
GetAtomNameA
GetLastError
GetProcAddress
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

_strdup
__dllonexit
__lc_codepage
__mb_cur_max
_assert
_errno
_flsbuf
_iob
_isctype
_pctype
_stricmp
_strnicmp
_winmajor
abort
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
free
fseek
ftell
fwrite
getenv
gmtime
localeconv
localtime
malloc
memchr
memcpy
memset
mktime
rand
realloc
sprintf
sscanf
strchr
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtod
strtol
time
vfprintf
wcslen

winmm

timeGetTime

ws2_32

WSAGetLastError
WSASetLastError
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ntohl
recv
send
setsockopt
socket

libeay32

BN_CTX_free
BN_CTX_new
BN_bin2bn
BN_bn2bin
BN_cmp
BN_copy
BN_free
BN_hex2bn
BN_mod_exp
BN_new
BN_num_bits
BN_set_word
BN_sub_word
BN_value_one
DH_compute_key
DH_free
DH_generate_key
DH_new
EVP_sha256
HMAC_CTX_cleanup
HMAC_CTX_init
HMAC_Final
HMAC_Init_ex
HMAC_Update
OpenSSL_add_all_digests
RC4
RC4_set_key

libssl32

SSL_CTX_ctrl
SSL_CTX_new
SSL_CTX_set_default_verify_paths
SSL_connect
SSL_free
SSL_library_init
SSL_load_error_strings
SSL_new
SSL_read
SSL_set_fd
SSL_shutdown
SSL_write
SSLv23_method

Exports

Exports

AMF3CD_AddProp
AMF3CD_GetProp
AMF3Prop_Decode
AMF3ReadInteger
AMF3ReadString
AMF3_Decode
AMFProp_Decode
AMFProp_Dump
AMFProp_Encode
AMFProp_GetBoolean
AMFProp_GetName
AMFProp_GetNumber
AMFProp_GetObject
AMFProp_GetString
AMFProp_GetType
AMFProp_IsValid
AMFProp_Reset
AMFProp_SetName
AMF_AddProp
AMF_CountProp
AMF_Decode
AMF_DecodeArray
AMF_DecodeBoolean
AMF_DecodeInt16
AMF_DecodeInt24
AMF_DecodeInt32
AMF_DecodeLongString
AMF_DecodeNumber
AMF_DecodeString
AMF_Dump
AMF_Encode
AMF_EncodeBoolean
AMF_EncodeInt16
AMF_EncodeInt24
AMF_EncodeInt32
AMF_EncodeNamedBoolean
AMF_EncodeNamedNumber
AMF_EncodeNamedString
AMF_EncodeNumber
AMF_EncodeString
AMF_GetProp
AMF_Reset
HTTP_get
RTMPPacket_Alloc
RTMPPacket_Dump
RTMPPacket_Free
RTMPPacket_Reset
RTMPProtocolStrings
RTMPProtocolStringsLower
RTMPSockBuf_Close
RTMPSockBuf_Fill
RTMPSockBuf_Send
RTMP_Alloc
RTMP_ClientPacket
RTMP_Close
RTMP_Connect
RTMP_Connect0
RTMP_Connect1
RTMP_ConnectStream
RTMP_DefaultFlashVer
RTMP_DeleteStream
RTMP_DropRequest
RTMP_EnableWrite
RTMP_FindFirstMatchingProperty
RTMP_FindPrefixProperty
RTMP_Free
RTMP_GetDuration
RTMP_GetNextMediaPacket
RTMP_GetTime
RTMP_HashSWF
RTMP_Init
RTMP_IsConnected
RTMP_IsTimedout
RTMP_LibVersion
RTMP_Log
RTMP_LogGetLevel
RTMP_LogHex
RTMP_LogHexString
RTMP_LogPrintf
RTMP_LogSetCallback
RTMP_LogSetLevel
RTMP_LogSetOutput
RTMP_LogStatus
RTMP_ParsePlaypath
RTMP_ParseURL
RTMP_Pause
RTMP_Read
RTMP_ReadPacket
RTMP_ReconnectStream
RTMP_SendChunk
RTMP_SendClientBW
RTMP_SendCreateStream
RTMP_SendCtrl
RTMP_SendPacket
RTMP_SendPause
RTMP_SendSeek
RTMP_SendServerBW
RTMP_Serve
RTMP_SetBufferMS
RTMP_SetOpt
RTMP_SetupStream
RTMP_SetupURL
RTMP_Socket
RTMP_TLS_Init
RTMP_TLS_ctx
RTMP_ToggleStream
RTMP_UpdateBufferMS
RTMP_UserInterrupt
RTMP_Write
RTMP_ctrlC
RTMP_debuglevel
_get_output_format
adler32
adler32_combine
adler32_combine64
crc32
crc32_combine
crc32_combine64
get_crc_table
inflate
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflate_copyright
inflate_fast
inflate_table
strtime
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e971542efa5e49dfc92263b7078330b

Headers

File Characteristics

Imports

kernel32

msvcrt

winmm

ws2_32

libeay32

libssl32

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 89KB

.data Size: 1024B - Virtual size: 720B

.rdata Size: 27KB - Virtual size: 26KB

.bss Size: - Virtual size: 2KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 89KB - Virtual size: 89KB

.data
Size: 1024B - Virtual size: 720B

.rdata
Size: 27KB - Virtual size: 26KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 3KB - Virtual size: 3KB