EACore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

EACore.dll
Size

88KB
MD5

2554e4864294dc96a5b4548dd42c7189
SHA1

8e3b3c600ab812537a84409adfc5169518862fd3
SHA256

b25c79ba507a256c9ca12a9bd34def6a33f9c087578c03d083d7863c708eca21
SHA512

d8074bb68791560027d6e391110a36b6de604d6b73829bd1b1b89476f2e0a53398d6611129f3782a92b935115589763248fb90b6ba74ec5abb6d81dec3c12c1a
SSDEEP

1536:9gSxD3zFkkt0h0BJVSIKMDSiAJtaNQ2hyAr+u6IHnQz0SuRPeJPqHO4LyFffbGqS:9gSNxkka0BRKMDSiAJtChyAr+u6IHnQq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EACore.dll

Files

EACore.dll
.dll windows:6 windows x86 arch:x86

d7b40c7a58929630429c343781a071bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\admin\source\repos\YK0130\Release\YK0130.pdb

Imports

kernel32

CloseHandle
CreateMutexA
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetSystemTimeAsFileTime
GetVolumeInformationA
InitializeCriticalSection
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
OpenMutexA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObject
lstrlenA

advapi32

GetUserNameA

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Random_device@std@@YAIXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?good@ios_base@std@@QBE_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uncaught_exception@std@@YA_NXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

ws2_32

WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
recv
send
setsockopt
shutdown
socket

vcruntime140

_CxxThrowException
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
_except_handler4_common
_purecall
memchr
memcmp
memcpy
memmove
memset

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-crt-runtime-l1-1-0

_beginthread
_cexit
_configure_narrow_argv
_endthread
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_seh_filter_dll

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

strlen
wcslen

Exports

Exports

AgentAdd
AgentRemove
AgentTaskAdd
AgentTaskRemove
AgentTaskStatusGet
AgentTaskStatusSet
Command
Connect
Connect3
Disconnect
IsConnected
ItemClearCache
ItemDecryptCancel
ItemDecryptStart
ItemDownloadCancel
ItemDownloadStart
ItemDownloadTogglePauseState
ItemEnumPatches
ItemGetStatus
ItemInstallStart
ItemInstallStartBatch
ItemUnpackCancel
ItemUnpackStart
ItemUse
StateGet
StateSetProperty
StateSetTag
UserEnumContent
UserGetEntitlements
UserGetNames
UserIsLoggedIn
UserLogin
UserLogout
ViewSetContentFilters

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7b40c7a58929630429c343781a071bd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 1KB

.00cfg Size: 512B - Virtual size: 4B

.rsrc Size: 512B - Virtual size: 232B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.00cfg
Size: 512B - Virtual size: 4B

.rsrc
Size: 512B - Virtual size: 232B

.reloc
Size: 2KB - Virtual size: 1KB