up[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
up.dll
Size 45.7MB
Sample241014-jlehtasbpe
SHA256 5546076ae6554a76b243471a4a3c3d002ef80b7504282c05c2a4fb923c8b77fd
MD5 96b46f6f511442e7a1b5daa125ced491
SHA1 337f4b6d92b567c30b90de1666f8adb32b457ee2
SHA512 e5b359cac7eaaf7255734a86e562706061ed133c09b3ca6a54c3aa2cdae36e60e8766b38dc4d31ca74bff768f6a4a63e90baeca10e64ce7819927effddd6686e
SSDEEP 24576:ab5Wyc+GYmc0guuEtMQxmbW0dH580xYIwzO0Zzp:ab8ysYm5ax580/wK0Zzp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
up.dll

File Explorer

up.dll

.dll 45.7MB

up.dll

IMPHASH 121cde6d75e4ec93f689fa0e0c5acf93
SHA256 5546076ae6554a76b243471a4a3c3d002ef80b7504282c05c2a4fb923c8b77fd
MD5 96b46f6f511442e7a1b5daa125ced491
SHA1 337f4b6d92b567c30b90de1666f8adb32b457ee2
SHA512 e5b359cac7eaaf7255734a86e562706061ed133c09b3ca6a54c3aa2cdae36e60e8766b38dc4d31ca74bff768f6a4a63e90baeca10e64ce7819927effddd6686e
SSDEEP 24576:ab5Wyc+GYmc0guuEtMQxmbW0dH580xYIwzO0Zzp:ab8ysYm5ax580/wK0Zzp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

349243

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable

opengl32

wglGetCurrentDC

user32

EnumWindows WindowFromDC GetWindowThreadProcessId GetKeyState GetMessageExtraInfo ScreenToClient ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCursor GetClientRect IsWindowUnicode SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx GetSystemMetrics SendInput

oleaut32

SysStringLen SafeArrayPutElement SysAllocString SysFreeString SafeArrayGetLBound SafeArrayDestroy VariantInit SafeArrayGetUBound SafeArrayGetElement SafeArrayCreateVector

kernel32

GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx GetConsoleOutputCP WriteFile FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetStdHandle LCMapStringW HeapFree HeapAlloc ReadFile ExitProcess FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError InterlockedFlushSList RtlUnwind VirtualFree GetCurrentProcess GetModuleHandleA Sleep CloseHandle CreateThread GetProcAddress GetCurrentProcessId FreeLibrary WideCharToMultiByte K32QueryWorkingSetEx VirtualProtect VirtualAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW MultiByteToWideChar GetLastError IsProcessorFeaturePresent DeleteCriticalSection CreateToolhelp32Snapshot Module32FirstW GetModuleHandleW Module32NextW VirtualQuery GetModuleFileNameW VirtualFreeEx GetCurrentThreadId GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter RaiseException FreeLibraryWhenCallbackReturns DecodePointer SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize InitializeCriticalSectionEx GetSystemTimeAsFileTime LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW InitializeSListHead SetStdHandle CreateFileW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW CreateThreadpoolWork

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext