version[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.dll
Size 1.8MB
Sample240901-rvs2katepd
SHA256 c67c356f90a9964a75be1d49ad387d081b0a7acd855b4368cde292a3df14e6ff
MD5 71892eaee1bc18fb2ad7d0a5e252494d
SHA1 f8ef867f791b3e8a221358e231d4da46b43cb58b
SHA512 1b1d02740420adf73c90d9b0a8b4f353f8d7aa0ea560aca98503ee6d8e5d1599d5338b5c5aa2b2704461f9ea5c9ef082536cc613bbb5db9dd2b95233b7e413f3
SSDEEP 49152:qywh/Fr0gk6Wrc7leng5cHsXH90rU0K53pxUism:qyUrd5hL3P
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 1.8MB

version.dll

IMPHASH 8f39691237ee23fb9b526d1e7ea93c92
SHA256 c67c356f90a9964a75be1d49ad387d081b0a7acd855b4368cde292a3df14e6ff
MD5 71892eaee1bc18fb2ad7d0a5e252494d
SHA1 f8ef867f791b3e8a221358e231d4da46b43cb58b
SHA512 1b1d02740420adf73c90d9b0a8b4f353f8d7aa0ea560aca98503ee6d8e5d1599d5338b5c5aa2b2704461f9ea5c9ef082536cc613bbb5db9dd2b95233b7e413f3
SSDEEP 49152:qywh/Fr0gk6Wrc7leng5cHsXH90rU0K53pxUism:qyUrd5hL3P
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

908129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId SuspendThread ResumeThread GetLastError GetCurrentThread GetThreadContext FlushInstructionCache SetThreadContext VirtualQuery SetLastError GetProcAddress FreeLibrary LoadLibraryExW DisableThreadLibraryCalls CreateThread GetModuleHandleA K32GetModuleInformation FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency VerSetConditionMask VerifyVersionInfoW QueryPerformanceCounter VirtualAlloc FreeLibraryAndExitThread GetSystemDirectoryA HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx OutputDebugStringW WriteFile HeapAlloc HeapFree ReadFile ExitProcess GetCurrentProcess VirtualFree VirtualProtect GetModuleHandleW CloseHandle GetUserDefaultLocaleName WriteConsoleW GetFileType CreateSemaphoreW WaitForSingleObject FreeConsole ReleaseSemaphore FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SleepConditionVariableSRW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent RaiseException LocalFree GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx Sleep InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle SetEndOfFile

user32

GetWindowRect GetKeyState MonitorFromWindow ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxW GetKeyboardState DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ReleaseDC GetDC SystemParametersInfoW SetWindowLongW CallWindowProcW

gdi32

GetDeviceCaps SelectObject GetFontData DeleteObject CreateFontIndirectW

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

492KB

Virtual Size

491KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version.dll

kernel32

user32

gdi32

d3d11

imm32

generic