SecuriteInfo[.]com[.]BScope[.]Trojan[.]Dllhijack[.]25644[.]20940[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.BScope.Trojan.Dllhijack.25644.20940.dll
Size

577KB
MD5

b6504e3b58176f83f2dd2f74203ee5b5
SHA1

92f8343a04d4f5d2441d2167e244ee2e283e86f7
SHA256

fca0e609f495ba211400a74592586b43b5ee1de347bdfea429218c364f1c0a90
SHA512

bf6eafe300afc9a304270f2470ba0275ebc01cf10f914f606804644814dfc9ab6a1deaca5f7d79ea4e84bc2861cfc912c1132ae4d4d7bd45ef93ffc217c69172
SSDEEP

12288:dAE9GJdaD0r3PwJvoTCmhDW9H7VZ1/3LgP+t9o9+LRpC8fi:SzraWPwNod6H7Vz/3LgGrRLC8fi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.BScope.Trojan.Dllhijack.25644.20940.dll

Files

SecuriteInfo.com.BScope.Trojan.Dllhijack.25644.20940.dll
.dll windows:6 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\pc\Desktop\New folder (3)\d3d9-wrapper-d3d9-wrapper-v1.58\data\d3d9.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Exports

Exports

Direct3DCreate9

Sections

.text
Size: 569KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE