e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b.dll
Size

24.8MB
MD5

50c424218307e9cb81ce2b1febbbc9a4
SHA1

f57ddd3ac726bfa59de0edf309edac4d63c3bdae
SHA256

e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b
SHA512

a2eb3eb990685657811839cf3d6af582e8a8341615f28601c14f0d709f979b8d2db20f70b2aa5564d081bd5e60956e55546fa7b0214a0692aa60d14df2d40f3d
SSDEEP

393216:+iCfMh8Pf/v3ye4CJjQTqi9YnVDpzeH6aNtpJMjNzkoy4mF:kUhe/vLXxSaDF2NtjOZy4O

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b.dll

Files

e07dbe17a3ef5f5d09629da0d34d077166d3d1e0caec94f6c5b46f8dfb92228b.dll
.dll windows:6 windows x86 arch:x86

e0b374f572fac42208c459d786b3d85a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateEventA
OpenEventA
CreateIoCompletionPort
FormatMessageA
GetTempFileNameW
SleepEx
lstrcpyW
WideCharToMultiByte
GlobalMemoryStatusEx
DeleteCriticalSection
LocalFree
QueueUserAPC
FindResourceW
LoadResource
CloseHandle
GlobalAlloc
LockResource
TerminateThread
SetEvent
GetLastError
FormatMessageW
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetConsoleOutputCP
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
CreateEventW
PostQueuedCompletionStatus
WaitForSingleObject
FindClose
GetTempPathW
EnumResourceNamesW
GetEnvironmentVariableW
GetQueuedCompletionStatus
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
EnumResourceTypesW
CreateWaitableTimerW
lstrlenW
EnterCriticalSection
SetLastError
SetWaitableTimer
FindFirstFileW
SizeofResource
CreateDirectoryW
GetFileAttributesW
CreateFile2
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
CreateFileA
CreateFileW
GetFileAttributesA
GetFileInformationByHandle
GetFileType
GetFullPathNameW
ReadFile
WriteFile
PeekNamedPipe
GetExitCodeProcess
Sleep
GetStdHandle
SearchPathA
DuplicateHandle
SetHandleInformation
CreatePipe
GetCurrentProcess
CreateProcessA
OpenProcess
GetProcAddress
LoadLibraryA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleHandleW
InitializeCriticalSection
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
GetSystemInfo
VirtualFree
GetCurrentProcessId
GetSystemTimeAsFileTime
GetSystemTime
SystemTimeToFileTime
GetSystemDirectoryA
FreeLibrary
LoadLibraryW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionEx
QueryPerformanceFrequency
GetSystemDirectoryW
GetModuleHandleA
MoveFileExW
WaitForSingleObjectEx
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
PulseEvent
GetDiskFreeSpaceW
SetFilePointer
GetVersion
GetVersionExW
FlushFileBuffers
DeleteFileW
MoveFileW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
SignalObjectAndWait
ResetEvent
ReleaseMutex
CreateMutexW
CreateThread
LockFile
LockFileEx
UnlockFile
RaiseException
GetLocaleInfoEx
SwitchToThread
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
TryAcquireSRWLockExclusive
GetCurrentDirectoryW
FindFirstFileExW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetTimeZoneInformation
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
SetStdHandle

user32

GetUserObjectInformationW
MessageBoxA
MessageBoxW
GetProcessWindowStation

shell32

ShellExecuteW

ws2_32

__WSAFDIsSet
WSAIoctl
inet_ntop
inet_pton
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
sendto
recvfrom
getpeername
shutdown
socket
setsockopt
listen
freeaddrinfo
ntohl
gethostname
connect
closesocket
bind
accept
send
recv
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
htons
htonl
WSAGetLastError
gethostbyname
select
ntohs
getsockopt
getsockname
ioctlsocket
WSACleanup
WSAStartup
WSARecv
getaddrinfo
WSASend

bcrypt

BCryptGenRandom

shlwapi

PathFileExistsW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreW
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertOpenStore

advapi32

CryptSetHashParam
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptReleaseContext
CryptGenRandom

Exports

Exports

start

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18.3MB - Virtual size: 18.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0b374f572fac42208c459d786b3d85a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ws2_32

bcrypt

shlwapi

crypt32

advapi32

Exports

Exports

Sections

.text Size: 5.0MB - Virtual size: 5.0MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 76KB - Virtual size: 97KB

.rsrc Size: 18.3MB - Virtual size: 18.3MB

.reloc Size: 190KB - Virtual size: 190KB

.text
Size: 5.0MB - Virtual size: 5.0MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 76KB - Virtual size: 97KB

.rsrc
Size: 18.3MB - Virtual size: 18.3MB

.reloc
Size: 190KB - Virtual size: 190KB