msedge_elf[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
msedge_elf.dll.exe
Size 1.3MB
Sample251223-px92raypfv
SHA256 0d2d887adcdf6309c4532e75ddb508db33402c7a488c3e2b8943c6721dab6708
MD5 82f08a330f0ed7e3178fbf81eeaa18b5
SHA1 abb66ca320e068183f80e19a3f814330441e5fa9
SHA512 a10c9e01ea30f8115d3250f11e71327665d5f13eefc35203afbe60a55d9171a8e0b1451ca4d3f8d3febfb3a32b716a884fc6ed5693088ee66cbe69428a4e8d83
SSDEEP 24576:S4QvySMEBZP1F2ZM5lfl4epwuaeCSGPZ0Bb8FbwF0EG:S4QqS9JlfWepwTQQZNw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
msedge_elf.dll.exe

File Explorer

msedge_elf.dll.exe

.dll 1.3MB

msedge_elf.dll.exe

IMPHASH 85e02b8dc3af1881758d87cbf27319e2
SHA256 0d2d887adcdf6309c4532e75ddb508db33402c7a488c3e2b8943c6721dab6708
MD5 82f08a330f0ed7e3178fbf81eeaa18b5
SHA1 abb66ca320e068183f80e19a3f814330441e5fa9
SHA512 a10c9e01ea30f8115d3250f11e71327665d5f13eefc35203afbe60a55d9171a8e0b1451ca4d3f8d3febfb3a32b716a884fc6ed5693088ee66cbe69428a4e8d83
SSDEEP 24576:S4QvySMEBZP1F2ZM5lfl4epwuaeCSGPZ0Bb8FbwF0EG:S4QqS9JlfWepwTQQZNw
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

679176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegCreateKeyExW RegSetValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData CryptProtectData

kernel32

EncodePointer InitializeCriticalSectionEx CloseHandle CompareStringEx CompareStringOrdinal CopyFileW CreateDirectoryW CreateEventExW DuplicateHandle FileTimeToSystemTime FindClose FindFirstFileW FindNLSStringEx FindNextFileW FindStringOrdinal FormatMessageW FreeLibrary GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetLocaleInfoEx GetModuleFileNameW GetProcAddress GetStdHandle GetSystemTime GetTempPathW GetThreadPriority GetTickCount64 LCMapStringEx LoadLibraryExW LocalFree LocaleNameToLCID MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ResolveLocaleName SetEvent SetLastError SetThreadErrorMode Sleep SystemTimeToFileTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread FlushProcessWriteBuffers GetThreadContext SetThreadContext GetSystemTimeAsFileTime CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead

ole32

CoInitializeEx CoUninitialize CoGetApartmentType CoCreateGuid CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc

api-ms-win-crt-math-l1-1-0

log

api-ms-win-crt-string-l1-1-0

strcpy strcmp _stricmp strlen strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __acrt_iob_func __stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_initterm_e _seh_filter_dll abort _initterm _configure_narrow_argv _initialize_narrow_environment _cexit _execute_onexit_table _initialize_onexit_table _register_onexit_function terminate _crt_atexit

1UgrYjaXSTp22 4QL7jjUXQ8taeJBm4Uz1BsUgkB 4ygiyMJs 5YHrLB9ELQMpZ9qKfzPAffk 5nwiuZxGrOjzOOFfF2 6CsP79PdbRqT 6LuhC4tMPI3BLO 6ce4yW3gtynv5iCZ 7p9AXT6gmeTRpmhSs5u7OL0y 8DhHMFAUFUeVzA7iEKyU 8lvTHjdjyJCjdM4M ??0PwaHelperImpl@edge_pwahelper@@QEAA@XZ ??1PwaHelperImpl@edge_pwahelper@@UEAA@XZ ??_7PwaHelperImpl@edge_pwahelper@@6B@ ?AppendMojoServerBindingInfo@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z ?BadgeNotification@PwaHelperImpl@edge_pwahelper@@UEAAXW4BadgeNotificationType@mojom@2@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@Z ?BindWidgetManager@PwaHelperImpl@edge_pwahelper@@AEAAXV?$ScopedHandleBase@VMessagePipeHandle@mojo@@@mojo@@@Z ?DigitalGoodsAbortPaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z ?DigitalGoodsConsume@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@@Z@base@@@Z ?DigitalGoodsGetDetails@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@V?$allocator@V?$StructPtr@VItemDetails@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z ?DigitalGoodsInvokePaymentApp@PwaHelperImpl@edge_pwahelper@@UEAAXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$OnceCallback@$$A6AXW4PurchaseResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z ?DigitalGoodsListPurchaseHistory@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z ?DigitalGoodsListPurchases@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4BillingResponseCode@mojom@payments@@V?$vector@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@V?$allocator@V?$InlinedStructPtr@VPurchaseReference@mojom@payments@@@mojo@@@__Cr@std@@@__Cr@std@@@Z@base@@@Z ?GetAppAcquisitionDetail@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXW4AcquisitionInfoResponseCode@mojom@edge_acquisition_info@@V?$InlinedStructPtr@VAcquisitionDetails@mojom@edge_acquisition_info@@@mojo@@@Z@base@@@Z ?GetAppLocalFolderPath@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AXAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@W4LocalFolderResponseCode@mojom@edge_pwahelper@@@Z@base@@@Z ?InitMojo@PwaHelperImpl@edge_pwahelper@@AEAAXXZ ?InitializeAppUserModelIdForCurrentProcess@PwaHelperImpl@edge_pwahelper@@QEAA_NXZ ?IsCurrentAppPinnedToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXV?$OnceCallback@$$A6AX_N@Z@base@@@Z ?OnClientConnected@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVWaitableEvent@base@@@Z ?PinTileToStart@PwaHelperImpl@edge_pwahelper@@UEAAXXZ ?PinTileToTaskbar@PwaHelperImpl@edge_pwahelper@@UEAAXXZ ?SetPwaHwnd@PwaHelperImpl@edge_pwahelper@@UEAAX_K@Z ?SetSingletonProcessId@PwaHelperImpl@edge_pwahelper@@UEAAXI@Z ?Shutdown@PwaHelperImpl@edge_pwahelper@@AEAAXI@Z ?StartAppWithIncomingMojo@PwaHelperImpl@edge_pwahelper@@QEAAXVPlatformChannelEndpoint@mojo@@@Z ?StartAppWithPlatformChannel@PwaHelperImpl@edge_pwahelper@@QEAAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@@Z ?StartProcessWithMojoIPC@PwaHelperImpl@edge_pwahelper@@QEAAKPEAXV?$unique_ptr@VCommandLine@base@@U?$default_delete@VCommandLine@base@@@__Cr@std@@@__Cr@std@@V?$unique_ptr@VScopedTempDir@base@@U?$default_delete@VScopedTempDir@base@@@__Cr@std@@@45@@Z ?TryActivateInstance@PwaHelperImpl@edge_pwahelper@@AEAAXPEAVCommandLine@base@@@Z ?ValidateHandShake@PwaHelperImpl@edge_pwahelper@@AEAAXXZ BAq7j3tTmRlg8f7Nf0oDXs0u BJ2sD1vx1kw85z1mJZ9upjyXxr CboESWXcruqRu2fP7jGBlhhRtr ClearReportsBetween_ExportThunk CrashForException_ExportThunk DR5P7qAm4thFgIdEkBjcEYE2M DYUyk4hqiw5 DisableHook DrainLog DumpHungProcessWithPtype_ExportThunk DumpProcessWithoutCrash EdgeElfBeaconDetect EdgeGetElfCommandLine EdgeGetElfLoadThreadId EdgeGetInjectionMitigationStatus EdgeGetMitigationHistogramData EdgeModuleIsEnumerated EdgeModuleIsLoaded EnzPXaoqS FdZGIBRabdHZkJobHjWNWdzzdxSv8wV1 FlhdCt9 GeLJj6sVSM GetApplyHookResult GetBlockedModulesCount GetCrashReports_ExportThunk GetCrashpadDatabasePath_ExportThunk GetHandleVerifier GetInstallDetailsPayload GetProductInfo_ExportThunk GetUniqueBlockedModulesCount GetUploadConsent_ExportThunk GetUserDataDirectoryThunk GfQZAvGkTcnsvb3sx4UAM Glupw0PUPllmT96kBGtm4gifG I43EIzWkpQx4Bv7M01bSPu05 InjectDumpForHungInput_ExportThunk IsBrowserProcess IsExtensionPointDisableSet IsTemporaryUserDataDirectoryCreatedForHeadless IsThirdPartyInitialized JWaHj8tGVzkNej6MaJZ8PLy0JOwXo JqukBLti5Kbqz K2LVLzEv4kzNpfGAU21zWpK MDFevkgTSU MEQnf38hjPwFlJ5skAsudLWaWDOU84cv NcpxDcI6pKbtQkPVL NrmaKq1Kffc2rjqu30 PAUI1IXAy14NdKWeN83jxbVKtrx PQKQDCyYGqZNQ QiXeb494gqFWbRpontR6voLnS555svR8 Qu1Qt4MmhpGDxMYrISGtng7K7jpswYK R79jK2dpX1y2vJ94BkMUIUpoy5CHL RegisterLogNotification RequestSingleCrashUpload_ExportThunk SUfDvnMJQkyiu64O3NGB2S2 SetMetricsClientId SetTelemetryLevel_ExportThunk SetUploadConsent_ExportThunk SignalChromeElf SignalInitializeCrashReporting SkoO2V5X4f2aCq StartAppWithParameter UyiXsU06i4ibr3JXU WFhjqgAuP3ROnrF52a1EQrQrw4yBz WKPIGJc2XHMDK8elc3oPK9H Y8w1cXANabJ4qtbkWmq YG2bAF1w9xsjo9pUHbD4RhBn YZRm27LcQBiQs4Yx YqSUDz2BHKupa4 Z1JvCaUMdSOqW8AporL8y9LeRmrL5 Z3Jin5SOVVVC ZFC1iQ0DAKQNk8voR8YtrQEdIJI aKj23dN ajOUi3GuCRJhYnQDW0K6MbfKaf aloXZkWZ93UHwI0f0oqDb azAN6F4x6iBj4QS6fZ b22cmRJjpPFFo4urhJhcg4LM cd04UgGjcBKh9dVH7yzgBRhBx1a crhM0aiUb5T1P5yGQSPZJn dt0iqUDq4DhC e2nSS3U0yfO2jqaRzl eI137jPCtoMTbt gV1wzw37 gYmFnkv3d6p4ti hm6jIm1fn6gVT0oiT5bV hx3UF6HUlkJcKP9THjI8 hxfBonSOtL5vlwOx3k0w75sBM5Oi jGf8zab jr9j1Crlh kHcaefdbfuCMt kdDrVLNlnYb11brL39gGe8 nUVZYQjwPcCPoO14EFQa57qtTVLSuvJ oOOuR9ApGNMmg4f0CodK53TyqhABh ouu9z7jb651cP p5s0ykg4R7ErPePODs51LodFqg00pcz q13SULvAY77wmrFsk8ZHLl5nlS qQO44C0sPihlCZt01yygF8zHnrf3 rxCCOLmoLpXHEL5C4GENfD5T rxhi0l85RMEM1GyA sODhzknpelvIFXs sZRAceBaEqv2d3AsBSZ2GM sbeb2So6rCz1MgT2HcjLhzupMQpVDz3 skJnLmK4FYKdb7FgEQX uCjfTcftjN7Zz uJho94JePU89xwLR0rTvxdwmNId vtpG0V4ihn9bvxAdKTSj wyDonGMR8 yq8gBq6D3do1oqr1eYgvrVamb