edit[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
edit.dll.exe
Size 1.3MB
Sample260122-sdrb3sev2c
SHA256 799fda3ecc1dd25a3100b87ab8b41678a32ac761ecf75f59167eb77f91e0a3a1
MD5 b4336b206409550d78e0029065cdcc75
SHA1 b2ab7e371836a0ca427a47e3ab956c6a4611f3ae
SHA512 7de818e72f393e641fee6e1735693238fca858378f9363ca66581b7c7a2068c323376264e0dd7a96ba9efce556decaca743f409066e3127001ae54eb7cfe8859
SSDEEP 24576:3Re2BJvucgT2ptS0ZbLwBEFu56Suxjo2U4Llo8ArqEe1BC:3EIWcgT/Bd6SuxjCrQB
TLSH
T18C55AE15E3D812A8E627D638CBA15232E6B574560351B9DF0A9CD3152FB3ED0AB3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edit.dll.exe

File Explorer

edit.dll.exe

.dll 1.3MB

edit.dll.exe

IMPHASH 209af022651db410186719002f7b1b8a
SHA256 799fda3ecc1dd25a3100b87ab8b41678a32ac761ecf75f59167eb77f91e0a3a1
MD5 b4336b206409550d78e0029065cdcc75
SHA1 b2ab7e371836a0ca427a47e3ab956c6a4611f3ae
SHA512 7de818e72f393e641fee6e1735693238fca858378f9363ca66581b7c7a2068c323376264e0dd7a96ba9efce556decaca743f409066e3127001ae54eb7cfe8859
SSDEEP 24576:3Re2BJvucgT2ptS0ZbLwBEFu56Suxjo2U4Llo8ArqEe1BC:3EIWcgT/Bd6SuxjCrQB
TLSH
T18C55AE15E3D812A8E627D638CBA15232E6B574560351B9DF0A9CD3152FB3ED0AB3F312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

818432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue CancelThreadpoolIo CloseHandle CloseThreadpoolIo CreateEventExW CreateFileMappingW CreateFileW CreateProcessW CreateThreadpoolIo DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FormatMessageW FreeLibrary GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException SetEvent SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS StartThreadpoolIo SystemTimeToFileTime TerminateProcess TzSpecificLocalTimeToSystemTime UnmapViewOfFile VirtualAlloc VirtualFree WaitForMultipleObjectsEx WakeConditionVariable WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime ResetEvent InitializeCriticalSectionEx SleepEx DebugBreak WaitForSingleObject GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemAlloc CoGetApartmentType CoUninitialize CoWaitForMultipleHandles CoTaskMemFree CoCreateGuid CoInitializeEx

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

calloc _callnewh free malloc

api-ms-win-crt-math-l1-1-0

modf

api-ms-win-crt-string-l1-1-0

wcsncmp strlen _stricmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _seh_filter_dll _initterm_e _execute_onexit_table _configure_narrow_argv _register_onexit_function abort _cexit terminate _initialize_onexit_table _initterm _initialize_narrow_environment

_el_add_char _el_alloc_array _el_basic_file_break_characters _el_basic_word_break_characters _el_check_root_identity _el_clean_exit _el_compl_array _el_compl_index _el_completer_word_break_characters _el_ctrl_c_pressed _el_delete_char _el_dir_name _el_display_first_hist _el_display_history _el_display_last_hist _el_display_next_hist _el_display_prev_hist _el_file_name _el_find_history_file _el_fn_qsort_string_compare _el_free_array _el_get_compl_text _el_grow_buffers _el_h_in _el_h_out _el_history_set_pos _el_hs _el_insert_char _el_line_buffer _el_line_buffer_size _el_mb2w _el_move_cursor _el_n_compl _el_next_compl _el_next_history _el_old_arg _el_pad _el_prev_in_cm _el_prev_in_cm_saved _el_prev_out_cm _el_prev_out_cm_saved _el_prev_sbInfo_saved _el_prev_size _el_previous_history _el_print _el_print_string _el_prompt _el_prompt_len _el_remove_tail_spaces _el_replace_char _el_set_cursor _el_signal_handler _el_temp_print _el_temp_print_size _el_text _el_text_mb _el_w2mb _el_wide _el_write_history_helper add_history append_history clear_history current_history free_history free_history_entry history_get history_length history_list history_set_pos history_truncate_file next_history previous_history read_history readline remove_history replace_history_entry rl_attempted_completion_function rl_attempted_completion_over rl_basic_word_break_characters rl_completer_word_break_characters rl_completion_append_character rl_completion_entry_function rl_completion_matches rl_end rl_filename_completion_function rl_free rl_library_version rl_line_buffer rl_point rl_prompt rl_readline_name rl_readline_version rl_user_completion_entry_free_function source_editrc using_history where_history write_history