SafeGuard[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

SafeGuard.dll
Size

14.6MB
MD5

61a1d4459a58516d8abe86595293cff2
SHA1

80a01fcb6ec285a43ef3e845d264958a217b071d
SHA256

f805bd8c52f9235ae4ee309d3f14df1f1af2a94391dd94e50c97daeed700bcd9
SHA512

549f93af83a5f534f059e69414aa5e9d3f45e4f8e109c9b5a14e9fce47d750676db7df246b0bb6cb050ce3c6a4b04d099517b31d6b105befab4c62fd34f80ee2
SSDEEP

196608:+G/P/Ol6hu81OBYWqnGAxqlqDX+hLqll2IlgvBSUoL/GsS7WxYMDCWb4iuPBI3e:P/Rd1hz1tQLs2ImZZoLehiGMOQPUB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SafeGuard.dll

Files

SafeGuard.dll
.dll windows:6 windows x64 arch:x64

dd7c49e59d78370c5d54ac1d7b4094eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

NtTerminateProcess

kernel32

InitializeProcThreadAttributeList
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

PostQuitMessage

advapi32

AdjustTokenPrivileges

shell32

ShellExecuteA

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z

ws2_32

accept

winhttp

WinHttpAddRequestHeaders

bcrypt

BCryptOpenAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-runtime-l1-1-0

_cexit

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

_dsign

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-time-l1-1-0

_time64

Exports

Exports

?antiDebugging@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@XZ
?antiVirtualization@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@XZ
?authenticateUser@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@XZ
?displayMessageBox@SafeGuardSDK@SafeGuard@@QEAAXW4StatusCode@2@@Z
?displayMessageBox@SafeGuardSDK@SafeGuard@@QEAAXW4StatusCode@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?downloadFile@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
?downloadFileToMemory@SafeGuardSDK@SafeGuard@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@V34@@Z
?injectDll@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@1@Z
?keyAuthenticateUser@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?loginUser@SafeGuardSDK@SafeGuard@@QEAAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z
?registerUser@SafeGuardSDK@SafeGuard@@QEAAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z
?upgradeUser@SafeGuardSDK@SafeGuard@@QEAAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z

Sections

.text
Size: - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Fm;
Size: - Virtual size: 13.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.}{3
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.{=j
Size: 14.6MB - Virtual size: 14.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd7c49e59d78370c5d54ac1d7b4094eb

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

shell32

msvcp140

ws2_32

winhttp

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 343KB

.rdata Size: - Virtual size: 109KB

.data Size: - Virtual size: 19KB

.pdata Size: - Virtual size: 13KB

.Fm; Size: - Virtual size: 13.3MB

.}{3 Size: 4KB - Virtual size: 3KB

.{=j Size: 14.6MB - Virtual size: 14.6MB

.reloc Size: 512B - Virtual size: 116B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 343KB

.rdata
Size: - Virtual size: 109KB

.data
Size: - Virtual size: 19KB

.pdata
Size: - Virtual size: 13KB

.Fm;
Size: - Virtual size: 13.3MB

.}{3
Size: 4KB - Virtual size: 3KB

.{=j
Size: 14.6MB - Virtual size: 14.6MB

.reloc
Size: 512B - Virtual size: 116B

.rsrc
Size: 512B - Virtual size: 469B