libemv[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

libemv.dll
Size

248KB
MD5

f2eab90ad9d2a2166d31216e8f935013
SHA1

13943b6c37118e3d85e4ce47e1d635526d3cb7f1
SHA256

fb037b4fa9732946abaa8d1e052c7b848230ef6ed26b8b46d105001b9025f218
SHA512

4dd05695dee21a59571878ece7e89566bd9144b91a487c5f2b0acd2a2ed26653cb90d7e6b63bd440be3af6da22a1525ba650d5cbb8a444a79844495c69f941ec
SSDEEP

3072:CeM5JRTkwAmSyRzhGQbuSmhBdPP0f3C4Jd8d6QeBevzqG/gA:CeM5fTkwAPyRTuSG+f3C0dtQw8zW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libemv.dll

Files

libemv.dll
.dll windows:4 windows x86 arch:x86

f08e3deff036a97fa9266f630f2dfe04

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ReadFile
WriteFile
FlushFileBuffers
GetLastError
MoveFileA
DeleteFileA
CreateDirectoryA
GetFileInformationByHandle
GetTickCount
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
SleepEx
GetModuleFileNameA
SetCommTimeouts
SetCommState
PurgeComm
SetFilePointer
HeapReAlloc
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile

msvcrt

rand
_ftol
localtime
time
strstr
toupper
tolower
atoi
srand
difftime
memchr
strncat
free
realloc
malloc
_initterm
_adjust_fdiv
strchr
strncpy
sprintf
memmove
_stricmp

Exports

Exports

LE_Close
LE_ConfigProcess
LE_ConfigTerminal
LE_Create
LE_EncryptBuffer
LE_Execute
LE_Free
LE_GetInfo
LE_GetStatusMessage
LE_GetTLV
LE_GetValue
LE_Open
LE_SetValue
LE_ShowMessage
LE_ShowMessageEx
LE_TabEMVEnd
LE_TabEMVInit
LE_TabEMVRec
LE_TabEMVSetParam
LE_TabEMVTimeStamp
_LE_Close@8
_LE_ConfigProcess@8
_LE_ConfigTerminal@24
_LE_Create@0
_LE_EncryptBuffer@12
_LE_Execute@12
_LE_Free@4
_LE_GetInfo@12
_LE_GetStatusMessage@12
_LE_GetTLV@12
_LE_GetValue@12
_LE_Open@8
_LE_SetValue@12
_LE_ShowMessage@8
_LE_ShowMessageEx@8
_LE_TabEMVEnd@4
_LE_TabEMVInit@8
_LE_TabEMVRec@8
_LE_TabEMVSetParam@8
_LE_TabEMVTimeStamp@12

Sections

.text
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f08e3deff036a97fa9266f630f2dfe04

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 177KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 32KB - Virtual size: 41KB

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 180KB - Virtual size: 177KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 32KB - Virtual size: 41KB

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 12KB - Virtual size: 9KB