Crypt C[.]dll | Triage

Sharing

General

Target

Crypt C.dll
Size

5.5MB
MD5

8d252f7a6ff4f929d86cf7feb95a5b08
SHA1

fa67e72ea1f9a6018407490359007022c784bdf8
SHA256

46a1eec81e8b0d889b6fde07a85405874d4b21da998b34e8b91fd852d1ddb458
SHA512

297ab8de6d887c1807bbbb49a04fe83c74874bf8647ab16e69f1680551c4dc50153affc92395c6c0705309df33a035c3368eba67d17220562f3c8c98a5c27f29
SSDEEP

98304:DW0704A7pKmwDNRdBYaAGmOGio38um37R6BJZO4A5cfebV/FkZQ:DW044gnwPnbAGmO83OR6BJZ9ATF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Crypt C.dll

Files

Crypt C.dll
.dll windows:1 windows x86 arch:x86

93b46cf2d15d8642e4c951c33e99ef12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
RtlMoveMemory
ExitProcess

user32

GetMessageA
TranslateMessage
DispatchMessageA

Exports

Exports

start

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 42B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 48B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE