borlndmm[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
borlndmm.dll
Size 2.8MB
Sample240713-pvb2yatapd
SHA256 18a26f67712f75a9251e8350089fc83d55c33f2fa82c46e5f67f1d6dc5716a4a
MD5 eb6fad4894d0b420b92c00acda8122ae
SHA1 8be6dfa8e216d2f7b68f2ab05e63a78fa51374f6
SHA512 4cbaad723076f539788acca418dcc9234d0c9d2978978a855cd670a6ad2300ebe4bb28c35fc048494df30c9d76bead5b6aae1b26168e6e0b230d34ac8797202e
SSDEEP 49152:1MkOevf30HlhHRPErtXFqVn1P2Rt8fUaRMXA3IloTf7OFk/41NjwT7x7uFh1hz:kY1Un1P2Rt8fUaRMXkuwB7uF5z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
borlndmm.dll

File Explorer

borlndmm.dll

.dll 2.8MB

borlndmm.dll

IMPHASH dd6ba004004c70f4eb3bbd4c9ec97b28
SHA256 18a26f67712f75a9251e8350089fc83d55c33f2fa82c46e5f67f1d6dc5716a4a
MD5 eb6fad4894d0b420b92c00acda8122ae
SHA1 8be6dfa8e216d2f7b68f2ab05e63a78fa51374f6
SHA512 4cbaad723076f539788acca418dcc9234d0c9d2978978a855cd670a6ad2300ebe4bb28c35fc048494df30c9d76bead5b6aae1b26168e6e0b230d34ac8797202e
SSDEEP 49152:1MkOevf30HlhHRPErtXFqVn1P2Rt8fUaRMXA3IloTf7OFk/41NjwT7x7uFh1hz:kY1Un1P2Rt8fUaRMXkuwB7uF5z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1367216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AdobePIM.pdb

msi

ord147 ord74 ord145

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcessModules

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

shlwapi

PathIsFileSpecW PathAddExtensionW PathRemoveFileSpecA PathIsDirectoryA PathIsDirectoryEmptyW PathIsSystemFolderW PathIsRootW PathRenameExtensionW PathIsDirectoryW PathAppendW PathRemoveBackslashW PathStripPathW PathAppendA PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathFileExistsA PathRemoveExtensionW

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetFolderLocation SHGetSpecialFolderPathW SHGetKnownFolderPath SHGetPathFromIDListW SHGetFolderPathW ord680 CommandLineToArgvW ord51 SHCreateItemFromParsingName

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpSetCredentials WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption

kernel32

TlsFree TlsSetValue TlsGetValue CompareStringW SwitchToThread InitializeCriticalSectionAndSpinCount GetStringTypeW EncodePointer TlsAlloc GetLocaleInfoW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetTimeZoneInformation ExitProcess GetStdHandle GetFileType IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleCP FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSectionEx GetLastError RaiseException DecodePointer DeleteCriticalSection ReleaseSemaphore CreateMutexW WaitForSingleObject LocalAlloc ReleaseMutex Sleep OpenSemaphoreW CloseHandle LocalFree GetCurrentProcessId CreateSemaphoreW CreateDirectoryW GetTempPathW MultiByteToWideChar SetEvent ResetEvent GetCommandLineW CreateProcessW GetLocalTime GetTimeFormatW GetDateFormatW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW FindFirstFileW FindNextFileW TerminateProcess RemoveDirectoryW FindClose SetEnvironmentVariableW SetFileAttributesW CreateEventW GetDiskFreeSpaceExW CreateThread CopyFileW lstrcmpiW lstrcmpW GetExitCodeProcess AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LockFileEx GetFileSize GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetCurrentProcess GetFileSizeEx lstrlenW GetACP SizeofResource GetModuleFileNameW LockResource LoadResource FindResourceW MoveFileExW GlobalAlloc GlobalFree VerSetConditionMask GetModuleHandleW VerifyVersionInfoW SetLastError DuplicateHandle ProcessIdToSessionId TerminateThread FindResourceExW lstrcpyW QueryFullProcessImageNameW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime FileTimeToSystemTime OpenMutexW GetUserDefaultLCID LCMapStringW GetUserDefaultLangID GetUserDefaultUILanguage SetFilePointerEx ResumeThread SetStdHandle WriteConsoleW QueryPerformanceFrequency GetVersionExW CreateFileMappingW

user32

wsprintfW EnumWindows GetWindowThreadProcessId GetShellWindow

advapi32

InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl RegQueryValueExW FreeSid RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetNamedSecurityInfoW SetNamedSecurityInfoW LookupAccountSidW CreateWellKnownSid EqualSid GetTokenInformation DuplicateTokenEx GetUserNameW ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree CoInitialize CoCreateGuid StringFromGUID2 CLSIDFromProgID OleRun CLSIDFromString

oleaut32

SysStringLen VariantChangeType VariantInit SysFreeString SysAllocString VariantClear VariantCopy GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain