Solstice_3898A04A79[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Solstice_3898A04A79.dll
Size

15.3MB
MD5

5c66a3a204b407b9195cf05a73caf77d
SHA1

55448db9a85c3b49710a5b3d6a0dfc2d63be28d0
SHA256

9c8d67deac9bdd96e4b4301f015ce34c154128fa19e2893173112f8d852e35a2
SHA512

563ba28a6eb1a41aad7fb3c44e19f904d72718fdec72f7d826277b8627895ac9ea34109667cdd6e6dcc03405c05d192dced67bbe08e286fbcf56ebe01c5e3884
SSDEEP

196608:EonhYSLWPHfFdOR5jgxe54dDFzC4J+UZw9RWaiaWzIIJ:E4hYyW+2e5yDF+CItiaWk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Solstice_3898A04A79.dll

Files

Solstice_3898A04A79.dll
.dll windows:6 windows x64 arch:x64

192d7fd1e9c43200ae9101eebe3c24b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\solstice\cmake-build-Release\Solstice.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

dbghelp

SymLoadModuleEx
SymInitialize
SymGetOptions
SymSetOptions
SymUnloadModule64
SymGetLineFromAddr64
SymFromAddr
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
SymCleanup

d3d11

D3D11On12CreateDevice

d2d1

ord1

ws2_32

getaddrinfo
inet_ntoa

kernel32

SetEndOfFile
OutputDebugStringW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
MultiByteToWideChar
GlobalLock
WideCharToMultiByte
GlobalUnlock
GlobalAlloc
GlobalFree
CreateEventA
WaitForSingleObject
CloseHandle
GetModuleHandleA
LoadLibraryA
GetProcAddress
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetCurrentThread
SetUnhandledExceptionFilter
GetCurrentProcess
RtlCaptureContext
DisableThreadLibraryCalls
CreateThread
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32First
Module32Next
GetModuleFileNameA
GetLastError
LoadLibraryExA
CreateFileA
SetFilePointer
ReadFile
AllocConsole
SetConsoleTitleA
GetStdHandle
GetConsoleMode
SetConsoleMode
FreeConsole
VirtualQuery
K32GetModuleFileNameExA
VirtualProtect
K32GetModuleInformation
Sleep
FreeLibraryAndExitThread
VirtualFree
GetSystemInfo
VirtualAlloc
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
WriteFile
GetCurrentThreadId
SetStdHandle
WriteConsoleA
GetConsoleScreenBufferInfo
RtlUnwind
WriteConsoleW
HeapCreate
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
SetLastError
GetThreadTimes
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
InitializeCriticalSectionEx
GetFileType
GetTimeFormatW
GetModuleFileNameW
FormatMessageW
GetOEMCP
GetACP
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LoadLibraryW
LoadLibraryExW
ExitProcess
SetConsoleTextAttribute
ExitThread
GetDateFormatW
GetDynamicTimeZoneInformation
IsValidCodePage
HeapQueryInformation
HeapSize
DeleteFileW
WaitForThreadpoolWorkCallbacks
SetConsoleCtrlHandler
GetTimeZoneInformation
FlushFileBuffers
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FormatMessageA
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
RtlPcToFileHeader
RaiseException
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RtlCaptureStackBackTrace
IsProcessorFeaturePresent
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockShared
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
LocalFree
GetLocaleInfoEx

user32

ToAscii
GetKeyboardState
MapVirtualKeyA
GetKeyboardLayout
GetDpiForWindow
SetWindowLongPtrA
GetWindowRect
EnumWindows
GetWindowTextA
MessageBoxA
MonitorFromWindow
ReleaseDC
GetDC
SetProcessDPIAware
UnregisterClassA
ReleaseCapture
SetCapture
GetCapture
ScreenToClient
CreateWindowExA
GetMessageExtraInfo
SetCursorPos
ClientToScreen
GetForegroundWindow
GetKeyState
LoadCursorA
SetCursor
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
DefWindowProcA
DestroyWindow
RegisterClassExA
IsWindowUnicode
TrackMouseEvent

gdi32

DeleteObject
GetDeviceCaps
CreateRectRgn

ole32

CoInitializeEx
CoCreateFreeThreadedMarshaler

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

imm32

ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmGetColorizationColor
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

oleaut32

SysFreeString
SysAllocString
SysStringLen
SetErrorInfo
GetErrorInfo

vcomp140

_vcomp_for_static_end
_vcomp_for_static_simple_init
_vcomp_fork

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6.4MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 433KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

192d7fd1e9c43200ae9101eebe3c24b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

dbghelp

d3d11

d2d1

ws2_32

kernel32

user32

gdi32

ole32

advapi32

imm32

d3dcompiler_47

dwmapi

bcrypt

wininet

oleaut32

vcomp140

Sections

.text Size: 7.0MB - Virtual size: 7.0MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 6.4MB - Virtual size: 6.5MB

.pdata Size: 433KB - Virtual size: 433KB

_RDATA Size: 9KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 7.0MB - Virtual size: 7.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 6.4MB - Virtual size: 6.5MB

.pdata
Size: 433KB - Virtual size: 433KB

_RDATA
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 27KB - Virtual size: 27KB