_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6[.]dll

General

Target
_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6.dll
Size 413KB
Sample251112-dn49csxqay
SHA256 e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6
MD5 7062ff5c1677971ebb9731101de7f256
SHA1 6aab2a185940113b2a73b87c1e1718da00f423de
SHA512 bf03065f66b9477ae64b6cbd180aebafe24126fcc6bbb0ff44257d71753a16da5bd13fdca892dcb6c4429c146a68e0e27959df398c35541c31b55c6faf682d03
SSDEEP 6144:3qGa+YH3K7gXppZo39EeKd5htWgN6DbauSU4Ko2qYyw3MUR6ytq:aGalH7Y1KHh/6DplPyw3MUxq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6.dll

File Explorer

_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6.dll

.dll 413KB

_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6.dll

IMPHASH 7a8eae48cbeb9b498cff13262d717430
SHA256 e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6
MD5 7062ff5c1677971ebb9731101de7f256
SHA1 6aab2a185940113b2a73b87c1e1718da00f423de
SHA512 bf03065f66b9477ae64b6cbd180aebafe24126fcc6bbb0ff44257d71753a16da5bd13fdca892dcb6c4429c146a68e0e27959df398c35541c31b55c6faf682d03
SSDEEP 6144:3qGa+YH3K7gXppZo39EeKd5htWgN6DbauSU4Ko2qYyw3MUR6ytq:aGalH7Y1KHh/6DplPyw3MUxq
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

156252

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess ExitProcess WriteConsoleW CloseHandle CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

ntdll

NtCreateSection NtMapViewOfSection pow __chkstk

Name

.text

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6.dll

kernel32

ntdll

generic