Nlsdl[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Nlsdl.dll
Size

28KB
MD5

25ac9c6c97bf4128f513a1c43f5f248b
SHA1

f4931da6ab880185bc1f56421fda197bb74b8413
SHA256

91ad5c97d028e6f1029540db96d5ef61bbec992954ba6f1f099dd4bfa884de3e
SHA512

a2eb539608e9618cda8483b39c0c0f36aa303004e8de7e33649fd47478a9a17498364f2ecfa8ca79e0da0a07628b143ed3aec2ddf3924cb6c0e1e2226092ac66
SSDEEP

384:zID3v6VyMoDkJOjbRF58YiU8VLq7uafNI+27JYlfz5dWrKwW64jZ:a3v6gMooJib+rUILkRCJYlfzBge

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nlsdl.dll

Files

Nlsdl.dll
.dll windows:6 windows x86 arch:x86

c40e4f386e05d25565b22ec337e20885

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Nlsdl.pdb

Imports

msvcrt

_initterm
malloc
free
_amsg_exit
_XcptFilter

ntdll

RtlUnwind

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetProcAddress
SetLastError
GetVersionExW
GetLocaleInfoW
GetModuleHandleW
TerminateProcess
GetCurrentProcess

Exports

Exports

DownlevelGetParentLocaleLCID
DownlevelGetParentLocaleName
DownlevelLCIDToLocaleName
DownlevelLocaleNameToLCID

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ