libintl-8[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libintl-8.dll
Size

92KB
MD5

7f1ff6ad5ae39c57ef5b612318e2f622
SHA1

7e40e94c73a53ccecccdb3301ff0766d6b50ee2a
SHA256

d0ec6cbcfb1447c44c4af2a1332365c8fb3fed8bacd22026d54f2a6d501337c7
SHA512

b6cdf51a3f06251f65b49b01b75d894ddc229770a37336c4b8f85cd157ff9606940247dae1a00f3bec693a8dd1b9577dd417d6a718dd5a22df70147908b31be1
SSDEEP

1536:YENGJx5iWQhl/VaHvnZ3LBGPARpKBsTkbettik8OB9U45XzFV9T6TtcWU+ngEPw:YP5HQXYhBGPcpKBsT3tt7nBHXzFHT+D+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libintl-8.dll

Files

libintl-8.dll
.dll windows:4 windows x86 arch:x86

c88f1cd21fad34997773d337bbc3a5ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

DeleteCriticalSection
EnterCriticalSection
EnumResourceLanguagesA
FreeLibrary
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
VirtualQueryEx
WideCharToMultiByte

msvcr90

___lc_codepage_func
__dllonexit
__mb_cur_max
_amsg_exit
_close
_errno
_fstat64
_getcwd
_initterm
_iob
_lock
_mbsrchr
_onexit
_open
_read
_strdup
_stricmp
_stricmp
_strnicmp
_unlock
_vsnprintf
_vsnwprintf
abort
atoi
bsearch
calloc
fclose
feof
fgets
fopen
fputs
fputwc
free
fwrite
getenv
isalnum
isalpha
isspace
malloc
memcpy
memmove
putc
qsort
realloc
setlocale
sprintf
strcat
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strstr
strtoul
tolower
vfprintf
vfwprintf
vsprintf
wcschr
wcslen

libwinpthread-1

pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_init
pthread_mutexattr_settype
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock

Exports

Exports

__imp_libintl_version
__printf__
_nl_expand_alias
_nl_explode_name
_nl_find_domain
_nl_find_msg
_nl_language_preferences_default
_nl_load_domain
_nl_locale_name
_nl_locale_name_canonicalize
_nl_locale_name_default
_nl_locale_name_environ
_nl_locale_name_from_win32_LANGID
_nl_locale_name_from_win32_LCID
_nl_locale_name_posix
_nl_locale_name_thread
_nl_locale_name_thread_unsafe
_nl_log_untranslated
_nl_make_l10nflist
_nl_msg_cat_cntr
_nl_normalize_codeset
_nl_state_lock
bind_textdomain_codeset
bindtextdomain
dcgettext
dcngettext
dgettext
dngettext
gettext
iconv
iconv_close
iconv_open
libintl_asprintf
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dcigettext
libintl_dcngettext
libintl_dgettext
libintl_dngettext
libintl_fprintf
libintl_fwprintf
libintl_gettext
libintl_gettext_extract_plural
libintl_gettext_free_exp
libintl_gettext_germanic_plural
libintl_gettextparse
libintl_hash_string
libintl_ngettext
libintl_nl_current_default_domain
libintl_nl_default_default_domain
libintl_nl_default_dirname
libintl_nl_domain_bindings
libintl_once_singlethreaded
libintl_recursive_lock_init_multithreaded
libintl_relocate
libintl_set_relocation_prefix
libintl_setlocale
libintl_snprintf
libintl_sprintf
libintl_swprintf
libintl_textdomain
libintl_vasnprintf
libintl_vasnwprintf
libintl_vasprintf
libintl_version
libintl_vfprintf
libintl_vfwprintf
libintl_vprintf
libintl_vsnprintf
libintl_vsprintf
libintl_vswprintf
libintl_vwprintf
libintl_wprintf
locale_charset
module_handle
ngettext
textdomain
xmax
xsum
xsum3
xsum4

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c88f1cd21fad34997773d337bbc3a5ee

Headers

File Characteristics

Imports

advapi32

kernel32

msvcr90

libwinpthread-1

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 56KB

.data Size: 512B - Virtual size: 504B

.rdata Size: 19KB - Virtual size: 18KB

.bss Size: - Virtual size: 2KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 57KB - Virtual size: 56KB

.data
Size: 512B - Virtual size: 504B

.rdata
Size: 19KB - Virtual size: 18KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB