mama_si1883t2o[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

mama_si1883t2o.dll
Size

3.2MB
MD5

cd0dffdebb38787548ee2e4ef58579ae
SHA1

47b89a25be4048ba3ee1f560db765b21400c2a82
SHA256

4bc68563056127c22bfe968e8fb20697576bb4dcb851a84a16cf7c94cccccd23
SHA512

d4a1b14d079a2f40fde49ef7efd42e9f5738f726059709cb8a24c68aa243143a1b31883dba5906f4d133db6b3715257d8c4e4c670f118e7b1fc1e248c0f7ec30
SSDEEP

98304:albxXaj03m05eY0Dq6uZ6wc7lxO/77LDrn/q:atO0205eY0Dqgwc7bO+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mama_si1883t2o.dll

Files

mama_si1883t2o.dll
.dll windows:6 windows x86 arch:x86

d32a812bd064ccb18d7ab40d6bde232f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryW
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
GetModuleHandleExA
CreateThread
SetThreadAffinityMask
GetCurrentThread
VirtualQuery
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
VirtualAlloc
VirtualFree
AllocConsole
SetConsoleTitleA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
HeapCreate
VirtualProtect
CreateDirectoryA
GetFileAttributesA
GetLastError
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
LoadLibraryExA

user32

GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
MessageBoxA
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
SetClipboardData
ReleaseCapture
ScreenToClient
CallWindowProcA
SetWindowLongA
FindWindowA
GetKeyState
LoadCursorA

shell32

ShellExecuteA

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??Bios_base@std@@QBE_NXZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
_Cnd_init_in_situ
_Query_perf_frequency
_Query_perf_counter
_Cnd_destroy_in_situ
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_trylock
?_Random_device@std@@YAIXZ
_Thrd_hardware_concurrency
_Cnd_wait
_Thrd_id
_Thrd_join
_Cnd_broadcast
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xlength_error@std@@YAXPBD@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?good@ios_base@std@@QBE_NXZ

winmm

PlaySoundA

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow

ntdll

RtlUnwind

vcruntime140

__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
strchr
_setjmp3
longjmp
strrchr
memmove
__DestructExceptionObject
__std_type_info_destroy_list
memset
_CxxThrowException
_except_handler4_common
__current_exception_context
__current_exception
memcpy
memchr
strstr

api-ms-win-crt-stdio-l1-1-0

fputs
putchar
__stdio_common_vsprintf_p
clearerr
__p__fmode
__acrt_iob_func
__stdio_common_vsnprintf_s
fgets
__stdio_common_vfscanf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfprintf
_ftelli64
__stdio_common_vswscanf
getc
__stdio_common_vswprintf_p
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vsscanf
__stdio_common_vfwscanf
__stdio_common_vsprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
_pclose
__stdio_common_vfwprintf
_popen
_get_stream_buffer_pointers
tmpfile
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
fwrite
feof
fgetc
fclose
fflush
tmpnam
fputc
__stdio_common_vsprintf_s
fopen
freopen_s
ftell
_wfopen
fseek
ferror

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
calloc

api-ms-win-crt-filesystem-l1-1-0

remove
rename
_lock_file
_unlock_file

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
system
_initterm
_seh_filter_dll
_configure_narrow_argv
_beginthreadex
_initterm_e
abort
_errno
terminate
_execute_onexit_table
_initialize_narrow_environment
exit
_register_onexit_function
_initialize_onexit_table
strerror
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

__libm_sse2_expf
remainderf
__libm_sse2_atanf
_dsign
_fdsign
_ldsign
__libm_sse2_powf
__libm_sse2_sinf
_dclass
_fdclass
_ldclass
__libm_sse2_cosf
__libm_sse2_acosf
pow
log
log10
exp
sin
cos
tan
asin
acos
atan
sinh
cosh
tanh
atan2
fmod
_CIfmod
ceil
_libm_sse2_log_precise
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_log10_precise
roundf
_libm_sse2_cos_precise
_CIatan2
ldexp
fmaf
_libm_sse2_exp_precise

api-ms-win-crt-locale-l1-1-0

localeconv
setlocale
___lc_codepage_func

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtod
atof
strtoll
strtoull
atoi

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strncpy

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-time-l1-1-0

_difftime64
clock
_localtime64
_mktime64
strftime
_gmtime64
_time64

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 559KB - Virtual size: 558KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 576KB - Virtual size: 597KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d32a812bd064ccb18d7ab40d6bde232f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

msvcp140

winmm

imm32

ntdll

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 559KB - Virtual size: 558KB

.data Size: 576KB - Virtual size: 597KB

_RDATA Size: 10KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 87KB - Virtual size: 86KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 559KB - Virtual size: 558KB

.data
Size: 576KB - Virtual size: 597KB

_RDATA
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 87KB - Virtual size: 86KB