xlive[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

xlive.dll
Size

340KB
MD5

6e70086f3cfd00bdcc542025a986435f
SHA1

9b0675a670fd922d5858cbddc089380ffa20f921
SHA256

2239e7c6d22ace00ed44f48518cebcd31deac2c6e07629decf98a3899690ea25
SHA512

b1911ac28ed2ba2fc9fc426658b578e217567287ba56b5adffa950d25385e2282f1ede57cd8f29cd76ba2570a37d7e0d3f6dfa88bce58f913072538280afe607
SSDEEP

6144:gCfE/S6zfzG7TONH/25Qf6oh9BumvhvmfEsxhm3uv0rKLFuo:gNK6zfzGUH/25QyoPBumpixquvGdo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xlive.dll

Files

xlive.dll
.dll windows:5 windows x86 arch:x86

d5a16644ed8a44b37f472393154e9e8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\Builds\[kopie_robocze]\xliveless\Release\xlive.pdb

Imports

ws2_32

inet_ntoa
htons
ntohl
ntohs
htonl
WSAEventSelect
__WSAFDIsSet
WSAWaitForMultipleEvents
WSAResetEvent
WSASetEvent
WSACloseEvent
WSACreateEvent
WSASetLastError
WSAGetLastError
inet_addr
WSASendTo
sendto
WSASend
send
WSARecvFrom
recvfrom
WSARecv
recv
WSAGetOverlappedResult
select
accept
listen
connect
bind
getpeername
getsockname
getsockopt
setsockopt
ioctlsocket
shutdown
closesocket
socket
WSACleanup
WSAStartup

shlwapi

PathAppendA
PathRemoveFileSpecA
PathIsRelativeA

kernel32

DuplicateHandle
LoadLibraryW
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetStringTypeW
LCMapStringW
HeapReAlloc
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
GetVersionExW
GetModuleHandleA
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetProcessHeap
GetConsoleCP
GetFileType
GetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetCPInfo
GetOEMCP
CloseHandle
FreeConsole
GetModuleFileNameA
CreateFileA
WriteFile
WriteConsoleA
GetCurrentThreadId
GetLocalTime
CreateDirectoryA
FindFirstFileW
FindNextFileW
FindClose
SetEvent
CancelIo
Sleep
SetLastError
CreateThread
CreateMutexA
GetCurrentProcessId
GetSystemTime
SystemTimeToFileTime
CreateEventA
CreateDirectoryW
CreateFileW
FreeLibrary
LoadLibraryExW
GetACP
IsValidCodePage
HeapAlloc
HeapSize
WideCharToMultiByte
AreFileApisANSI
GetModuleHandleExW
ExitProcess
CreateSemaphoreW
GetTickCount
GetStartupInfoW
TerminateProcess
CreateEventW
VirtualQuery
VirtualProtect
GetThreadContext
SetThreadContext
InitializeCriticalSection
Thread32First
LeaveCriticalSection
Thread32Next
EnterCriticalSection
OpenThread
CreateToolhelp32Snapshot
DeleteCriticalSection
SuspendThread
ResumeThread
VirtualFree
VirtualAlloc
SetEndOfFile
GetCurrentProcess
GetCurrentThread
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
MultiByteToWideChar
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
CreateTimerQueue
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleHandleW
GetProcAddress
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount

user32

EnumWindows
GetDlgItemTextW
EndDialog
SetDlgItemTextW
DialogBoxParamA
SetWindowPos
GetWindowRect
GetDesktopWindow
GetWindowThreadProcessId
wsprintfW
SetWindowTextW

wintrust

WinVerifyTrust

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5a16644ed8a44b37f472393154e9e8a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

shlwapi

kernel32

user32

wintrust

Sections

.text Size: 226KB - Virtual size: 225KB

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 10KB - Virtual size: 327KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 226KB - Virtual size: 225KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 10KB - Virtual size: 327KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 13KB