browser[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

browser.dll
Size

132KB
MD5

d772413e1e9caa4dc5ca0ae152351b0b
SHA1

1affdeda3753ce1d2dce03e4993cdd929ba5a72e
SHA256

ffc3b43dc8bce9091b55b2693ac174a756dcda3f17f474c1a21a58eab8141f34
SHA512

6cc9b5c8ed5eaa49ca79409716560d978a7b1bd7c05b621881bcbb612171b8c0f2295be9027050c84f5e58bd86bfd2d78ea44d386e8027140ecab208f26c35d5
SSDEEP

1536:FiINSxjyt/CxaCPoZ3aeP3Ls6BdIbUEGc0paCW67drsT4eWp7ORs9hPFK1bnuZR1:gINE/eP7xdAT4xoM01bnuZ/c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
browser.dll

Files

browser.dll
.dll windows:6 windows x64 arch:x64

c51103b3a80c30bc7ab06eb2c2299369

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

browser.pdb

Imports

msvcrt

_ultoa
wcscat_s
sprintf_s
wcsncpy_s
vsprintf_s
_wcsnicmp
wcsspn
swprintf_s
strnlen
memcpy
_beginthreadex
memmove
_XcptFilter
_amsg_exit
free
malloc
_initterm
wcstoul
strcpy_s
_itow_s
memset
wcschr
__C_specific_handler
memcmp
_ultow
??3@YAXPEAX@Z
isdigit
qsort
strchr
wcscpy_s
_wcsicmp
mbstowcs
_local_unwind

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlAcquireResourceShared
RtlOemStringToUnicodeString
NtOpenProcessToken
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlLengthSid
RtlCopySid
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlNewSecurityObject
RtlDeleteSecurityObject
RtlCompareMemoryUlong
NtQueryInformationToken
RtlInitAnsiString
RtlUnicodeStringToOemString
RtlxUnicodeStringToOemSize
RtlUnicodeToOemN
NlsMbOemCodePageTag
NtImpersonateAnonymousToken
NtSetInformationThread
NtCreateFile
NtFsControlFile
RtlFreeOemString
RtlInitString
RtlDeleteResource
RtlInitializeResource
RtlEqualUnicodeString
RtlGetNtProductType
RtlTimeToSecondsSince1980
NtQuerySystemTime
NtQuerySystemInformation
RtlCompareMemory
RtlUpcaseUnicodeToOemN
NtQueryPerformanceCounter
NtDeviceIoControlFile
RtlCopyUnicodeString
NtCancelIoFile
NtOpenFile
RtlNtStatusToDosError
RtlUpcaseUnicodeStringToOemString
NtClose
RtlReleaseResource
RtlAcquireResourceExclusive
NtOpenEvent
RtlInitUnicodeString
NtOpenThreadToken

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
Sleep
CreateSemaphoreExW
CreateEventW
SetEvent
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
InitializeCriticalSection

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
SetThreadPriority
OpenThreadToken

api-ms-win-service-winsvc-l1-2-0

RegisterServiceCtrlHandlerW
QueryServiceStatus

rpcrt4

RpcStringFreeW
RpcRevertToSelf
RpcImpersonateClient
I_RpcExceptionFilter
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
NdrServerCallAll
NdrServerCall2
RpcServerUnregisterIf
RpcBindingFree
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcBindingServerFromClient

api-ms-win-service-core-l1-1-1

SetServiceStatus

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegQueryInfoKeyW
RegCloseKey
RegNotifyChangeKeyValue

netutils

NetpIsRemote
NetapipBufferAllocate
NetpIsUncComputerNameValid
NetApiBufferAllocate
NetpwNameCanonicalize
NetApiBufferFree
NetpIsRemoteNameValid

api-ms-win-core-sysinfo-l1-2-1

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetLocalTime

api-ms-win-core-file-l1-2-1

SetFilePointer
CreateFileW
DeleteFileW
WriteFile

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx
CreateTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalSize
LocalReAlloc
LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrcmpW

api-ms-win-security-base-l1-2-0

EqualSid
GetLengthSid
AccessCheck

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Exports

Exports

I_BrowserServerEnumForXactsrv
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c51103b3a80c30bc7ab06eb2c2299369

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-service-winsvc-l1-2-0

rpcrt4

api-ms-win-service-core-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

netutils

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-timezone-l1-1-0

Exports

Exports

Sections

.text Size: 114KB - Virtual size: 114KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 216B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 536B

.text
Size: 114KB - Virtual size: 114KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 536B