libbz2-1[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
libbz2-1.dll.exe
Size 3.3MB
Sample250519-hc2rbatm16
SHA256 cfe3100ff8dfe286be11b889ec8ca0a14211d56651469114ee5f440d8ff3e5a6
MD5 faec49512ce29772f35810ca830a0def
SHA1 ff7be42abaf57699aa1e01c999828d8f03b3b7c1
SHA512 f73c7a2e358c9ab512074aaa4d4e117d575371db8f0d8aea038b115405a97eed864b52f5e9e90235b99abc0a02f420dc7ccb21b45473a6e0f4708d91859b489c
SSDEEP 49152:zh65a6nCsjXMsP10BoR3Rn+jwUdYQkpsXD4hKwt0UhGpx/:qMi0aMipgpx/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libbz2-1.dll.exe

File Explorer

libbz2-1.dll.exe

.dll 3.3MB

libbz2-1.dll.exe

IMPHASH f54d88439b32bbd9e5bae81e83ce25aa
SHA256 cfe3100ff8dfe286be11b889ec8ca0a14211d56651469114ee5f440d8ff3e5a6
MD5 faec49512ce29772f35810ca830a0def
SHA1 ff7be42abaf57699aa1e01c999828d8f03b3b7c1
SHA512 f73c7a2e358c9ab512074aaa4d4e117d575371db8f0d8aea038b115405a97eed864b52f5e9e90235b99abc0a02f420dc7ccb21b45473a6e0f4708d91859b489c
SSDEEP 49152:zh65a6nCsjXMsP10BoR3Rn+jwUdYQkpsXD4hKwt0UhGpx/:qMi0aMipgpx/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegEnumValueW

bcrypt

BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptGenRandom

iphlpapi

if_nametoindex

kernel32

TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount TlsSetValue RaiseException RtlPcToFileHeader InterlockedFlushSList TlsFree EncodePointer SetLastError FormatMessageW GetLastError LocalFree GetConsoleMode GetFileType ReadFile ReadConsoleW WriteFile WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte K32EnumProcessModulesEx CloseHandle IsWow64Process GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess QueryPerformanceCounter CloseThreadpoolIo GetCurrentProcessId RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentThread Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW GetCPInfo LocalAlloc GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeleteVolumeMountPointW DeviceIoControl ExpandEnvironmentStringsW FindNextFileW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandleEx GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW RemoveDirectoryW SetFileInformationByHandle SetThreadErrorMode GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation GetCurrentProcessorNumberEx SetEvent CreateEventExW GetEnvironmentVariableW ExitProcess AllocConsole FreeConsole GetModuleHandleA LoadLibraryA GetModuleHandleW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoCreateGuid CoGetApartmentType CoTaskMemAlloc CoUninitialize CoInitializeEx CoWaitForMultipleHandles CoTaskMemFree

oleaut32

SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement SafeArrayGetDim VariantClear

secur32

GetUserNameExW

user32

LoadStringW

ws2_32

closesocket FreeAddrInfoW WSASocketW WSAStartup WSACleanup GetAddrInfoW gethostname

api-ms-win-crt-heap-l1-1-0

_callnewh calloc malloc free

api-ms-win-crt-math-l1-1-0

modf tan sin pow cos ceil floor

api-ms-win-crt-string-l1-1-0

strncpy_s strcpy_s _stricmp strcmp wcsncmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initterm_e _crt_atexit terminate abort _initialize_narrow_environment _cexit _initterm _execute_onexit_table _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsscanf __stdio_common_vsprintf_s __acrt_iob_func

Name

.text

Size

455KB

Virtual Size

455KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

libbz2-1.dll.exe

advapi32

bcrypt

iphlpapi

kernel32

ole32

oleaut32

secur32

user32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

generic