version[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.dll
Size 2.4MB
Sample240613-l36dzatfre
SHA256 08f43236ad8cda9afc551ee334eee3ee0fad76e9f6a1bf9b61727ef6703114c9
MD5 d78169f08bb3057d13ea8aa8a3e7bdd3
SHA1 6151e1f64bbd2c22e93b77d61f76e803936209ee
SHA512 144103cef39f43065a94d7554c70936e18a60c03fa843b0b07f7d278fc36fbf298cc054d1095a5ef826dc0f21be1eb4afd3b1aaf09a3c6430148d18a7aacfa5b
SSDEEP 49152:3/5thEDN+kSnUS75I/Z+xU6f7tBAtHfIR7dLSfDwP3HS3pOR/6n8EzjTDzqjmm:RL4EjAtHAR7Q30
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 2.4MB

version.dll

IMPHASH 132441a53a06cd867552c7276f533cd6
SHA256 08f43236ad8cda9afc551ee334eee3ee0fad76e9f6a1bf9b61727ef6703114c9
MD5 d78169f08bb3057d13ea8aa8a3e7bdd3
SHA1 6151e1f64bbd2c22e93b77d61f76e803936209ee
SHA512 144103cef39f43065a94d7554c70936e18a60c03fa843b0b07f7d278fc36fbf298cc054d1095a5ef826dc0f21be1eb4afd3b1aaf09a3c6430148d18a7aacfa5b
SSDEEP 49152:3/5thEDN+kSnUS75I/Z+xU6f7tBAtHfIR7dLSfDwP3HS3pOR/6n8EzjTDzqjmm:RL4EjAtHAR7Q30
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1206443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId SuspendThread ResumeThread GetLastError GetCurrentThread GetThreadContext FlushInstructionCache SetThreadContext VirtualQuery SetLastError GetProcAddress FreeLibrary LoadLibraryExW DisableThreadLibraryCalls CreateThread SizeofResource LockResource LoadResource FindResourceW GetModuleFileNameW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency VerSetConditionMask VerifyVersionInfoW QueryPerformanceCounter FreeLibraryAndExitThread FreeConsole VirtualAlloc HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW OutputDebugStringW WriteFile HeapFree HeapAlloc ReadFile ExitProcess ExitThread GetCurrentProcess VirtualFree VirtualProtect GetModuleHandleW CreateSemaphoreW CloseHandle WriteConsoleW GetFileType GetStdHandle TlsFree GetUserDefaultLocaleName WaitForSingleObject GetSystemDirectoryA ReleaseSemaphore FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive Sleep RaiseException IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW WakeAllConditionVariable SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize LocalFree GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue SetEndOfFile

user32

ReleaseDC MessageBoxW GetKeyState MonitorFromWindow ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyboardState DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW CallWindowProcW GetWindowRect GetDC SetWindowLongW SystemParametersInfoW

gdi32

GetDeviceCaps DeleteObject GetFontData SelectObject CreateFontIndirectW

shell32

ShellExecuteA

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

646KB

Virtual Size

645KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version.dll

kernel32

user32

gdi32

shell32

d3d11

imm32

generic