file[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.dll
Size

707KB
MD5

b61f507b24ebcab3ea69135a21e18df5
SHA1

1415666e5064843bd2a2fa5e62a74f03644766c7
SHA256

8af97d1537988d11e5efd0fe227289278b243663fe06aa34438a15896043719e
SHA512

c45156aba7455f9bcdc2dd978588e82fc6b4cce179699e1b83454835fe9c2f275c456476749832e1bd8b8ff5d3067024a15b4736b127044b609eb6e106cf2416
SSDEEP

12288:YXWc7yBJK3iqs5t6jr3i/da1buPTYupzedqkyOXEem:2Wc7yBc3iqsbyS/E1b2JZK0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.dll

Files

file.dll
.dll regsvr32 windows:6 windows x86 arch:x86

d99296399554c9c4f9947ff988397392

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetCommandLineW
GetEnvironmentStrings
DecodePointer
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessorNumber
GetTickCount
GetTickCount64
GetLargePageMinimum
GetModuleHandleA
lstrlenA
lstrlenW
IsValidCodePage
GetACP
GetOEMCP
GetSystemDefaultLangID
GetSystemDefaultLCID
GetThreadUILanguage
SetUnhandledExceptionFilter
MultiByteToWideChar
CreateFileW
CloseHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
SetFilePointerEx
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
GetModuleFileNameW
WriteConsoleW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwind
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess

user32

ArrangeIconicWindows
GetLastActivePopup
GetTopWindow
GetShellWindow
GetParent
GetCaretPos
GetCursorPos
GetWindowTextLengthA
GetUpdateRect
EndPaint
BeginPaint
GetWindowDC
EndMenu
GetSubMenu
DestroyMenu
GetSystemMenu
GetMenu
IsWindowUnicode
GetCapture
GetFocus
GetActiveWindow
GetDialogBaseUnits
GetDlgCtrlID
IsZoomed
AnyPopup
IsIconic
IsWindowVisible
EndDeferWindowPos
BeginDeferWindowPos
OpenIcon
IsWindow
GetDoubleClickTime
IsWow64Message
GetMessageExtraInfo
GetMessageTime
GetMessagePos
GetCursor

shlwapi

StrSpnA
StrCmpIW

Exports

Exports

CPlApplet
DllRegisterServer
DllUnregisterServer
_DllUninitialize@8
_DllUpdate@12
_DllUpdate@16
_Export@16
_GetDllVersion@20
_InitDll@20
_RegisterDll@8
_UnregisterDll@16
_UnregisterDll@4

Sections

.text
Size: 529KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d99296399554c9c4f9947ff988397392

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

Exports

Exports

Sections

.text Size: 529KB - Virtual size: 528KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 3KB - Virtual size: 4.2MB

.reloc Size: 50KB - Virtual size: 49KB

.text
Size: 529KB - Virtual size: 528KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 3KB - Virtual size: 4.2MB

.reloc
Size: 50KB - Virtual size: 49KB