instalador[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

instalador.dll
Size

3.1MB
MD5

44f12564ac2966728fd8533d186a860b
SHA1

06c502abb0803aa6da6e8153448b83038d266cf3
SHA256

6400c06d4751f198788d73902c692a5c67cea70cf8ec5705a2a61abc3963389d
SHA512

07c9c8e8a7a4cb75dab46c98b90c9a5e12949900cb5ce566d40e9c293b079cf0be7292a9b3cbde16eb0a3413afbb5693bb686385eb52ccb04955e26c732d13d8
SSDEEP

49152:bhrq8+ZeZbDT1rO3xTzwvuKlv+GNbEbUQQMmLGPLb7Zin8:bpv+G9oQMmW7Zin

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
instalador.dll

Files

instalador.dll
.dll windows:6 windows x64 arch:x64

65d6957056119b1c669d10b9feea445b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

minhadll.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
CloseHandle
GetProcessHeap
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
HeapAlloc
HeapFree
ReadFile
GetOverlappedResult
GetLastError
SetFileCompletionNotificationModes
FormatMessageW
LocalFree
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
GetTempPathW
GetProcAddress
GetTickCount64
GlobalMemoryStatusEx
GetModuleHandleA
GetLogicalDrives
GetDiskFreeSpaceExW
GetProcessTimes
GetExitCodeProcess
GetFullPathNameW
CreateThread
GetComputerNameExW
WideCharToMultiByte
WriteConsoleW
MultiByteToWideChar
OpenProcess
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetFileAttributesW
CreateProcessW
GetSystemTimes
GetProcessIoCounters
GetWindowsDirectoryW
VirtualQueryEx
ReadProcessMemory
GetSystemDirectoryW
WaitForMultipleObjects
ReadFileEx
CreateNamedPipeW
ExitProcess
GetModuleFileNameW
GetModuleHandleW
SetHandleInformation
GetSystemInfo
GetCurrentProcessId
CreateFileW
GetConsoleMode
CancelIo
CreateEventW
GetFinalPathNameByHandleW
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
RemoveDirectoryW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
IsProcessorFeaturePresent
DeleteFileW
GetStdHandle
WriteFileEx
SleepEx
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
FindFirstFileW
HeapReAlloc
lstrlenW
ReleaseMutex
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW

secur32

ApplyControlToken
AcceptSecurityContext
InitializeSecurityContextW
LsaFreeReturnBuffer
FreeContextBuffer
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
LsaGetLogonSessionData
EncryptMessage
DeleteSecurityContext
QueryContextAttributesW
LsaEnumerateLogonSessions

ws2_32

ioctlsocket
WSAStartup
getsockname
WSACleanup
recv
shutdown
getpeername
WSAGetLastError
freeaddrinfo
getsockopt
WSASend
bind
getaddrinfo
closesocket
WSASocketW
connect
WSAIoctl
setsockopt
send

advapi32

RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
LookupAccountSidW
RegCloseKey
OpenProcessToken

crypt32

CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain

oleaut32

VariantClear
SysAllocString
SysFreeString

ntdll

NtQuerySystemInformation
RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtReadFile
NtWriteFile
NtCreateFile
RtlGetVersion
NtQueryInformationProcess

pdh

PdhOpenQueryA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity

iphlpapi

GetAdaptersAddresses
GetIfTable2
FreeMibTable
GetIfEntry2

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

vcruntime140

_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
memset
__std_type_info_destroy_list
__C_specific_handler
memmove

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initterm_e
_initialize_narrow_environment
_cexit
_initialize_onexit_table
_execute_onexit_table
_initterm
_configure_narrow_argv

Exports

Exports

init

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65d6957056119b1c669d10b9feea445b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

secur32

ws2_32

advapi32

crypt32

oleaut32

ntdll

pdh

powrprof

psapi

shell32

ole32

iphlpapi

netapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 9KB - Virtual size: 9KB

.pdata Size: 103KB - Virtual size: 103KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 9KB - Virtual size: 9KB

.pdata
Size: 103KB - Virtual size: 103KB

.reloc
Size: 16KB - Virtual size: 16KB