main_usa[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

main_usa.dll
Size

13.8MB
MD5

a18db4d2e464befcf2ed0727212455b0
SHA1

e10014828ea4fc5bd805e4112b418063c0afb1b6
SHA256

fd9e1f9284cdba556e9df2cb39f15bc38135b5a894d6bd271d8fd6882da5d42b
SHA512

7dc319a35deb28590f350a4ca3bd6b573dcef803325c75242ab838c28ade9c898e1a1bd8bd00836b40b24eab6ca2972571bb5e8c8c3e3e48bde0d17db0bd8138
SSDEEP

393216:GH4hEwexCvBziFkSWicomE+5cANQ8ww6fLoMXW:1hOxCvBwk3omE+CANQ8wwsLpXW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
main_usa.dll

Files

main_usa.dll
.dll windows:0 windows x64 arch:x64

1bc00d0d590e082f2f5f9851473fee40

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

gdi32

AddFontResourceW
CheckColorsInGamut
CreateBrushIndirect
DdNotifyFullscreenSpriteUpdate
DeleteObject
DrawEscape
EngCheckAbort
EngFindResource
EngMultiByteToWideChar
EngStretchBlt
EnumEnhMetaFile
EnumFontsA
ExtCreateRegion
FONTOBJ_cGetGlyphs
FlattenPath
GdiConvertFont
GdiDeleteSpoolFileHandle
GdiEntry15
GdiEntry16
GdiEntry7
GdiFixUpHandle
GdiGradientFill
GdiPlayScript
GdiQueryFonts
GetAspectRatioFilterEx
GetCurrentPositionEx
GetEnhMetaFileA
GetFontFileInfo
GetMapMode
GetPhysicalMonitorDescription
GetRgnBox
GetTextCharset
GetWinMetaFileBits
Pie
PolyTextOutA
PolylineTo
RealizePalette
RemoveFontResourceW
ScaleWindowExtEx
SetBkMode
SetICMMode
StartDocW
TextOutW

kernel32

CreateFileMappingA
CreateHardLinkW
CreateJobObjectA
CreateJobObjectW
CreateSemaphoreExA
CreateUmsThreadContext
CreateWaitableTimerW
DeleteFileA
DeleteFileTransactedA
DeviceIoControl
DisableThreadLibraryCalls
EnumCalendarInfoExA
EnumDateFormatsExEx
ExpandEnvironmentStringsW
FatalExit
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileTransactedW
FindFirstVolumeA
FlsAlloc
FlsFree
FlushViewOfFile
GetConsoleAliasW
GetConsoleCursorInfo
GetConsoleNlsMode
GetConsoleTitleW
GetConsoleWindow
GetCurrencyFormatA
GetCurrentDirectoryA
GetExitCodeProcess
GetFileAttributesExA
GetLogicalDrives
GetLogicalProcessorInformation
GetNumaProcessorNode
GetNumberOfConsoleFonts
GetProcAddress
GetSystemDefaultLangID
GetSystemTimes
GetThreadId
GetThreadLocale
GetUserDefaultLangID
GetUserGeoID
GetVersionExA
GetVolumePathNameW
GlobalGetAtomNameA
HeapCompact
HeapDestroy
IsBadCodePtr
IsValidCodePage
IsValidLanguageGroup
LZCopy
LoadLibraryA
LocateXStateFeature
MoveFileExA
MoveFileTransactedW
MoveFileWithProgressA
PrepareTape
QueryThreadCycleTime
ReadConsoleA
ReadConsoleInputA
ReleaseMutex
ReleaseSRWLockExclusive
SetComputerNameA
SetConsoleFont
SetConsoleOutputCP
SetConsoleWindowInfo
SetThreadErrorMode
TerminateJobObject
TlsAlloc
TransmitCommChar
UpdateResourceA
WaitCommEvent
WakeAllConditionVariable
WriteFileEx
lstrcmpiW
lstrcpyA
lstrlenA

msvcrt

clock
fgetpos
fgets
free
fwprintf_s
getwc
iswalpha
iswspace
malloc
memcpy
memset
raise
rename
rewind
strncat
strspn
strtok
strtoul
swscanf
wcslen
wctomb_s
wprintf
_tell
_strrev
_spawnve
_putch
_memicmp
_memccpy
_getcwd
_execv
_strnicmp
_stricmp

shell32

ExtractAssociatedIconExA
GetCurrentProcessExplicitAppUserModelID
ILFindLastID
ILGetSize
ILIsParent
InternalExtractIconListA
PathIsExe
PathIsSlowW
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
SHBrowseForFolder
SHCreateDirectory
SHCreateShellFolderViewEx
SHCreateShellItem
SHDoDragDrop
SHGetDataFromIDListA
SHGetFileInfo
SHGetIconOverlayIndexW
SHGetItemFromDataObject
SHGetItemFromObject
SHGetKnownFolderPath
SHGetPropertyStoreFromIDList
SHLimitInputEdit
SHParseDisplayName
SignalFileOpen
WOWShellExecute
WaitForExplorerRestartW

user32

AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BlockInput
BroadcastSystemMessage
CancelShutdown
ChangeWindowMessageFilterEx
CopyRect
DispatchMessageW
DrawFrameControl
EndMenu
EnumDesktopWindows
EnumDisplaySettingsExA
EnumPropsExW
FindWindowExA
GetAncestor
GetClipboardData
GetClipboardViewer
GetDlgItemInt
GetGUIThreadInfo
GetGestureInfo
GetKeyboardType
GetMenuInfo
GetMenuItemID
GetMenuState
GetMenuStringA
GetProgmanWindow
GetRawInputDeviceInfoA
GetSystemMetrics
GetThreadDesktop
GetTouchInputInfo
GetWindowDC
GetWindowModuleFileNameA
GetWindowWord
InternalGetWindowIcon
IsCharAlphaA
IsDialogMessage
IsTouchWindow
LoadBitmapA
MessageBoxExA
MsgWaitForMultipleObjectsEx
RegisterErrorReportingDialog
SetDoubleClickTime
SetPropA
SetShellWindow
SetShellWindowEx
SetWindowRgn
SetWindowTextA
ShutdownBlockReasonCreate
ShutdownBlockReasonQuery
TabbedTextOutW
ToUnicode
UnloadKeyboardLayout

Exports

Exports

Algonquin_photojournalists_puncturing
Antioch_onusesNazarene
Durkheim_plighted_emigrated
anxiety_glorified
appetizer_besot_concreted
artiest_honorary
ascribe_pallor_clownishness
audits_pitifully_retrospects
caffeinated_lymphatics
comfortingly_gagging_insufficiency
confectioneries_regroupAlison
cotyledon_hatchery
defrosts_garages_gerund
demilitarizing_bedroom
excited_poorlyThackeray
instigator_acolyte_compatible
least_marts
lupine_pawpaws
lustre_piece_campaigner
maims_carapace
minored_emphasized
mysterious_wights
pelvic_criminologists_pints
performMexico_aspires
prefiguring_spayed_circumnavigated
projectile_millennia
restudy_scorchers_preheated
robuster_entrapping_endways
semiotics_pizzazz_coauthors
snap_corroborates
structurallyChristensen_hieroglyphic
violet_o
watermarks_urinate

Sections

.text
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 452KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1bc00d0d590e082f2f5f9851473fee40

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

kernel32

msvcrt

shell32

user32

Exports

Exports

Sections

.text Size: 8.4MB - Virtual size: 8.4MB

.data Size: 452KB - Virtual size: 456KB

.rdata Size: 4.9MB - Virtual size: 4.9MB

.edata Size: 1KB - Virtual size: 4KB

.idata Size: 9KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 8.4MB - Virtual size: 8.4MB

.data
Size: 452KB - Virtual size: 456KB

.rdata
Size: 4.9MB - Virtual size: 4.9MB

.edata
Size: 1KB - Virtual size: 4KB

.idata
Size: 9KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 52KB - Virtual size: 51KB