DLL[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DLL.dll
Size

633KB
MD5

e0ae16ee5f9b0e3a19210b1abe78e8a5
SHA1

aa679a225562614584b201ff740d70005b4e0c94
SHA256

1f3c6b454cf3a8e71351613ca86c5f4c0ee7d4648798a2864a3824da99c78ae7
SHA512

182bf559d4efd75d558b9f6a4f8d46f25ea0e63e295ccc69696644f4f78700ef4021c82abea532caf70471b5982d9442ad63c7797d07378e57c588e724ec6776
SSDEEP

12288:D5xNgDHxCRvs14lolhj79hVoTJjWlqJigZp2PveSi/1hOV:FxuHgRvsqlE9hSFWlqJigZp2PvexhOV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DLL.dll

Files

DLL.dll
.dll windows:6 windows x64 arch:x64

f46e2fa396992b1fbc636c54c324052c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\user\source\repos\real\x64\Release\DLL.pdb

Imports

ws2_32

WSACleanup
setsockopt
getsockopt
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
connect
WSAStartup
ntohs
WSAGetLastError
WSASetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockname

normaliz

IdnToUnicode
IdnToAscii

crypt32

CryptStringToBinaryA
CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain

wldap32

ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord143
ord200
ord301
ord30

kernel32

CreateFileA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
GetCurrentProcessId
WaitForMultipleObjects
InitializeSListHead
PeekNamedPipe
ReadFile
GetFileType
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileSizeEx
SetLastError
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
FormatMessageW
GetLastError
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
MultiByteToWideChar
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
CreateThread
AllocConsole
GetCurrentProcess
Sleep
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx

advapi32

GetTokenInformation
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
OpenProcessToken

shell32

ShellExecuteExA

msvcp140

?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
memcmp
_CxxThrowException
__std_type_info_destroy_list
memmove
memchr
strrchr
strchr
memset
memcpy
__std_terminate
__std_exception_copy
strstr
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

calloc
realloc
malloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

strtol
wcstombs
strtoul
strtod
strtoull
atoi
strtoll

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-runtime-l1-1-0

system
_initterm_e
_beginthreadex
__sys_errlist
__sys_nerr
_invalid_parameter_noinfo_noreturn
_initterm
_cexit
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
exit

api-ms-win-crt-stdio-l1-1-0

fclose
_lseeki64
fputs
fgets
_open
__stdio_common_vsprintf
fopen
_fseeki64
_write
fflush
_fileno
_close
fputc
fwrite
__stdio_common_vsscanf
_read
freopen_s
__stdio_common_vswprintf
__acrt_iob_func
feof
fread
fseek
ftell

api-ms-win-crt-math-l1-1-0

_fdopen
_dsign

api-ms-win-crt-string-l1-1-0

strpbrk
strncmp
strncpy
strspn
_strdup
strcmp
strcspn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
_stat64

Sections

.text
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f46e2fa396992b1fbc636c54c324052c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

normaliz

crypt32

wldap32

kernel32

advapi32

shell32

msvcp140

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Sections

.text Size: 483KB - Virtual size: 483KB

.rdata Size: 119KB - Virtual size: 118KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 23KB - Virtual size: 23KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 483KB - Virtual size: 483KB

.rdata
Size: 119KB - Virtual size: 118KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 2KB - Virtual size: 2KB