libcurl-4[.]dll

Resubmissions

Sharing

Copy URL Twitter E-mail

General

Target

libcurl-4.dll
Size

640KB
MD5

faf4ead29bd7ca8f68f7bf1a64f08f68
SHA1

98cd83efa3fae22237a297482acadc9a261d0daa
SHA256

c89290dbf75ffd761d942e2df22006532c5e94dec84d3a64b431c311b180d589
SHA512

801d7a63a646bbd42bd7b36fc4772694b39b950d227b727566975db36914e486194e92b1fd268c1de7d940f6302b34f667587f9a266e56b7dfcc483b2168d295
SSDEEP

12288:j+eSTZ757z/x/4kcujh4Gr669amTpPpppHdrHHIPiL:j+tTZ757tPjhkaamTpVdLHIPiL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libcurl-4.dll

Files

libcurl-4.dll
.dll windows:4 windows x64 arch:x64

296721d816366fef16986d6d92013926

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libgnutls-30

gnutls_alert_get
gnutls_alert_get_name
gnutls_alpn_get_selected_protocol
gnutls_alpn_set_protocols
gnutls_bye
gnutls_certificate_allocate_credentials
gnutls_certificate_free_credentials
gnutls_certificate_get_peers
gnutls_certificate_set_verify_flags
gnutls_certificate_set_x509_crl_file
gnutls_certificate_set_x509_key_file
gnutls_certificate_set_x509_key_file2
gnutls_certificate_set_x509_system_trust
gnutls_certificate_set_x509_trust_dir
gnutls_certificate_set_x509_trust_file
gnutls_certificate_verify_peers2
gnutls_check_version
gnutls_cipher_get
gnutls_cipher_suite_get_name
gnutls_credentials_set
gnutls_deinit
gnutls_error_is_fatal
gnutls_global_deinit
gnutls_global_init
gnutls_handshake
gnutls_init
gnutls_kx_get
gnutls_mac_get
gnutls_ocsp_resp_deinit
gnutls_ocsp_resp_get_single
gnutls_ocsp_resp_import
gnutls_ocsp_resp_init
gnutls_ocsp_status_request_enable_client
gnutls_ocsp_status_request_get
gnutls_ocsp_status_request_is_checked
gnutls_pk_algorithm_get_name
gnutls_priority_set_direct
gnutls_protocol_get_name
gnutls_protocol_get_version
gnutls_pubkey_deinit
gnutls_pubkey_export
gnutls_pubkey_import_x509
gnutls_pubkey_init
gnutls_record_check_pending
gnutls_record_get_direction
gnutls_record_recv
gnutls_record_send
gnutls_rnd
gnutls_server_name_set
gnutls_session_get_data
gnutls_session_set_data
gnutls_set_default_priority
gnutls_srp_allocate_client_credentials
gnutls_srp_free_client_credentials
gnutls_srp_set_client_credentials
gnutls_strerror
gnutls_transport_set_errno
gnutls_transport_set_ptr
gnutls_transport_set_pull_function
gnutls_transport_set_push_function
gnutls_x509_crt_check_hostname
gnutls_x509_crt_check_issuer
gnutls_x509_crt_deinit
gnutls_x509_crt_get_activation_time
gnutls_x509_crt_get_dn2
gnutls_x509_crt_get_dn_by_oid
gnutls_x509_crt_get_expiration_time
gnutls_x509_crt_get_issuer_dn2
gnutls_x509_crt_get_pk_algorithm
gnutls_x509_crt_get_version
gnutls_x509_crt_import
gnutls_x509_crt_init

libgss-3

GSS_C_NT_HOSTBASED_SERVICE
gss_delete_sec_context
gss_display_name
gss_display_status
gss_import_name
gss_init_sec_context
gss_inquire_context
gss_release_buffer
gss_release_name
gss_unwrap
gss_wrap

libidn2-0

idn2_check_version
idn2_free
idn2_lookup_ul
idn2_to_unicode_8z8z

libnettle-8

nettle_des_encrypt
nettle_des_set_key
nettle_md4_digest
nettle_md4_init
nettle_md4_update
nettle_md5_digest
nettle_md5_init
nettle_md5_update
nettle_sha256_digest
nettle_sha256_init
nettle_sha256_update

libpsl-5

psl_builtin
psl_check_version_number
psl_free
psl_is_cookie_domain_acceptable
psl_latest

librtmp-1

RTMP_Alloc
RTMP_Close
RTMP_Connect1
RTMP_ConnectStream
RTMP_Free
RTMP_Init
RTMP_Read
RTMP_SetBufferMS
RTMP_SetupURL
RTMP_Write

libssh2-1

libssh2_agent_connect
libssh2_agent_disconnect
libssh2_agent_free
libssh2_agent_get_identity
libssh2_agent_init
libssh2_agent_list_identities
libssh2_agent_userauth
libssh2_channel_free
libssh2_channel_read_ex
libssh2_channel_send_eof
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_write_ex
libssh2_exit
libssh2_hostkey_hash
libssh2_init
libssh2_knownhost_add
libssh2_knownhost_checkp
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_writefile
libssh2_scp_recv2
libssh2_scp_send64
libssh2_session_abstract
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_set_blocking
libssh2_session_set_read_timeout
libssh2_sftp_close_handle
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_userauth_authenticated
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey_fromfile_ex
libssh2_version

zlib1

inflate
inflateEnd
inflateInit2_
inflateInit_
zlibVersion

libzstd

ZSTD_createDStream
ZSTD_decompressStream
ZSTD_freeDStream
ZSTD_isError
ZSTD_versionNumber

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive
CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetEnvironmentVariableA
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemDirectoryA
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MoveFileExA
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSRWLockExclusive
SetEvent
SetLastError
Sleep
SleepEx
TlsGetValue
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

atoi
strtol
strtoll
strtoul
wcstombs

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_stat64
_unlink

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

memchr
memcmp
memcpy
memmove
strchr
strrchr
strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
__sys_errlist
__sys_nerr
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
perror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf
_close
_fileno
_fseeki64
_lseeki64
_open
_read
_write
fclose
feof
fflush
fgets
fopen
fputc
fread
fseek
ftell
fwrite

api-ms-win-crt-string-l1-1-0

_strdup
memset
strcmp
strcpy
strcspn
strlen
strncmp
strpbrk
strspn
wcslen

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_gmtime64
_time64
_tzset
strftime

api-ms-win-crt-utility-l1-1-0

qsort

libwinpthread-1

pthread_create
pthread_detach
pthread_join
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock

wldap32

ber_free
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_global_trace
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_get_handles
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info
curl_ws_meta
curl_ws_recv
curl_ws_send

Sections

.text
Size: 459KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

296721d816366fef16986d6d92013926

Headers

DLL Characteristics

File Characteristics

Imports

libgnutls-30

libgss-3

libidn2-0

libnettle-8

libpsl-5

librtmp-1

libssh2-1

zlib1

libzstd

bcrypt

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

libwinpthread-1

wldap32

ws2_32

Exports

Exports

Sections

.text Size: 459KB - Virtual size: 458KB

.data Size: 10KB - Virtual size: 9KB

.rdata Size: 96KB - Virtual size: 95KB

/4 Size: 512B - Virtual size: 4B

.pdata Size: 16KB - Virtual size: 15KB

.xdata Size: 16KB - Virtual size: 15KB

.bss Size: - Virtual size: 1KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 16KB - Virtual size: 16KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 459KB - Virtual size: 458KB

.data
Size: 10KB - Virtual size: 9KB

.rdata
Size: 96KB - Virtual size: 95KB

/4
Size: 512B - Virtual size: 4B

.pdata
Size: 16KB - Virtual size: 15KB

.xdata
Size: 16KB - Virtual size: 15KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 16KB - Virtual size: 16KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 3KB - Virtual size: 2KB