exodium v2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

exodium v2.dll
Size

8.6MB
MD5

234fab01e11d5775cba9766a70642280
SHA1

98b139cb07554108cb7d75e30cf09c2eda05b66a
SHA256

9cf7dd9b41becfb1d6d47aa7208ff54c759aeec89b99f43f85ef6b32453c135d
SHA512

bea7216549a432e17824dd95744552c64a9f54584ae0ac07167f75396e550f86266c5128854d3b19e922b0c6cf9cac8af2f11f9989f87d30754b4a00160706cd
SSDEEP

196608:/1Bwt/RY9XCo3nSnOuf8tNSPFOGJFQMhC7rwQa:PZ0o3nSnESPAZr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
exodium v2.dll

Files

exodium v2.dll
.dll windows:6 windows x86 arch:x86

4a3ce8693907375056dd2f1612d6f66c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Иван\Desktop\new menu\build\Win32\Release\222.pdb

Imports

kernel32

FindFirstFileA
FindNextFileA
FindClose
GetWindowsDirectoryA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
QueryPerformanceCounter
GetModuleFileNameA
LoadLibraryExA
GetLastError
FreeLibrary
FormatMessageA
CreateThread
GetCurrentProcess
GetModuleHandleA
K32GetModuleInformation
EnterCriticalSection
SetUnhandledExceptionFilter
FlushInstructionCache
VirtualProtect
FindFirstFileExW
FindNextFileW
AreFileApisANSI
CloseHandle
GetModuleHandleW
LeaveCriticalSection
GetTickCount
CreateDirectoryA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
IsDebuggerPresent
GetEnvironmentVariableA
InitializeSListHead
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SetEvent
TerminateProcess

user32

CloseClipboard
OpenClipboard
ReleaseCapture
SetCapture
GetCapture
GetCursorPos
SetCursorPos
EmptyClipboard
GetClientRect
GetAsyncKeyState
CallWindowProcA
SetCursor
GetForegroundWindow
IsChild
ClientToScreen
ScreenToClient
GetClipboardData
GetKeyState
SetClipboardData
wvsprintfW
LoadCursorA

shell32

SHGetFolderPathA

msvcp140

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?good@ios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?fail@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
_Xtime_get_ticks
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
_Thrd_sleep
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

d3dx9_43

D3DXCreateTextureFromFileInMemory
D3DXCreateTextureFromFileInMemoryEx

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

xinput1_4

ord4
ord2

vcruntime140

__CxxFrameHandler3
_purecall
__std_exception_destroy
__std_exception_copy
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
_setjmp3
memchr
memmove
memcpy
memcmp
memset
strrchr
longjmp
strchr
strstr

api-ms-win-crt-heap-l1-1-0

realloc
free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

system
_initterm_e
_initterm
exit
_invalid_parameter_noinfo_noreturn
abort
_cexit
strerror
_crt_atexit
_execute_onexit_table
terminate
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-math-l1-1-0

fmaxf
llround
_libm_sse2_atan_precise
roundf
_libm_sse2_cos_precise
round
ldexp
_libm_sse2_exp_precise
_libm_sse2_asin_precise
_libm_sse2_acos_precise
_dtest
_dsign
_libm_sse2_log_precise
_libm_sse2_pow_precise
_CIfmod
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_CIatan2
_libm_sse2_tan_precise
ceil
_fdtest
floor
frexp
_libm_sse2_log10_precise
_except1

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-stdio-l1-1-0

fopen
ferror
freopen
fgets
feof
setvbuf
clearerr
_pclose
fputc
fflush
fclose
__stdio_common_vsprintf_s
fgetc
tmpfile
_popen
fwrite
__stdio_common_vsprintf
fgetpos
ungetc
fsetpos
tmpnam
ftell
fseek
fread
_wfopen
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
getc
_ftelli64
__stdio_common_vswprintf_s
_get_stream_buffer_pointers
_fseeki64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
remove
_lock_file
rename

api-ms-win-crt-convert-l1-1-0

strtoull
strtoll
strtol
strtod
atof
atoi

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
setlocale
localeconv

api-ms-win-crt-string-l1-1-0

isgraph
isupper
tolower
isblank
isalpha
iscntrl
isspace
isalnum
ispunct
islower
strncpy
strncmp
isxdigit
toupper
strcoll
strcpy_s
isdigit
strspn
_stricmp
strpbrk

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
_gmtime64
_difftime64
clock
_mktime64
strftime

api-ms-win-crt-environment-l1-1-0

getenv

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 607KB - Virtual size: 607KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.8MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a3ce8693907375056dd2f1612d6f66c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

msvcp140

d3dx9_43

imm32

xinput1_4

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 607KB - Virtual size: 607KB

.data Size: 4.8MB - Virtual size: 9.7MB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 123KB - Virtual size: 123KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 607KB - Virtual size: 607KB

.data
Size: 4.8MB - Virtual size: 9.7MB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 123KB - Virtual size: 123KB