edit[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
edit.dll.exe
Size 1.4MB
Sample260122-sdrb3sev2d
SHA256 6a0f4ea2f4ba62e63cc8abac633ccefc97068eb2639eb9cfae6b26cfde7be1bf
MD5 fc74c469d8aeffd702c12d9a9d02876f
SHA1 a63ed7b7cff302d25db4dee2bb02d58ec3595ba5
SHA512 1ddee0cada7dabd6a94ab08390c826b031eb9208297d92160307a3a8e66a6cd00f14a2a78f1f5834ac886af5cc3fb473066c5f80d3c94cf5c9a40703994265a3
SSDEEP 24576:3KKbd5p2Pz4Iqd/IPDqS0gbZa0YBBO2/inkq+d4ZKVVY2GYeZUc:xPIrqd/ItYBF/ikh40DY3U
TLSH
T19065CF07E3D811ACE627C678CB926233E6B575560761A9CF0A98D3152FB3ED06B3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edit.dll.exe

File Explorer

edit.dll.exe

.dll 1.4MB

edit.dll.exe

IMPHASH 209af022651db410186719002f7b1b8a
SHA256 6a0f4ea2f4ba62e63cc8abac633ccefc97068eb2639eb9cfae6b26cfde7be1bf
MD5 fc74c469d8aeffd702c12d9a9d02876f
SHA1 a63ed7b7cff302d25db4dee2bb02d58ec3595ba5
SHA512 1ddee0cada7dabd6a94ab08390c826b031eb9208297d92160307a3a8e66a6cd00f14a2a78f1f5834ac886af5cc3fb473066c5f80d3c94cf5c9a40703994265a3
SSDEEP 24576:3KKbd5p2Pz4Iqd/IPDqS0gbZa0YBBO2/inkq+d4ZKVVY2GYeZUc:xPIrqd/ItYBF/ikh40DY3U
TLSH
T19065CF07E3D811ACE627C678CB926233E6B575560761A9CF0A98D3152FB3ED06B3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

818304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue CancelThreadpoolIo CloseHandle CloseThreadpoolIo CreateEventExW CreateFileMappingW CreateFileW CreateProcessW CreateThreadpoolIo DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FormatMessageW FreeLibrary GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException SetEvent SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS StartThreadpoolIo SystemTimeToFileTime TerminateProcess TzSpecificLocalTimeToSystemTime UnmapViewOfFile VirtualAlloc VirtualFree WaitForMultipleObjectsEx WakeConditionVariable WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime ResetEvent InitializeCriticalSectionEx SleepEx DebugBreak WaitForSingleObject GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemAlloc CoGetApartmentType CoUninitialize CoWaitForMultipleHandles CoTaskMemFree CoCreateGuid CoInitializeEx

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

calloc _callnewh free malloc

api-ms-win-crt-math-l1-1-0

modf

api-ms-win-crt-string-l1-1-0

wcsncmp strlen _stricmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _seh_filter_dll _initterm_e _execute_onexit_table _configure_narrow_argv _register_onexit_function abort _cexit terminate _initialize_onexit_table _initterm _initialize_narrow_environment

_el_add_char _el_alloc_array _el_basic_file_break_characters _el_basic_word_break_characters _el_check_root_identity _el_clean_exit _el_compl_array _el_compl_index _el_completer_word_break_characters _el_ctrl_c_pressed _el_delete_char _el_dir_name _el_display_first_hist _el_display_history _el_display_last_hist _el_display_next_hist _el_display_prev_hist _el_file_name _el_find_history_file _el_fn_qsort_string_compare _el_free_array _el_get_compl_text _el_grow_buffers _el_h_in _el_h_out _el_history_set_pos _el_hs _el_insert_char _el_line_buffer _el_line_buffer_size _el_mb2w _el_move_cursor _el_n_compl _el_next_compl _el_next_history _el_old_arg _el_pad _el_prev_in_cm _el_prev_in_cm_saved _el_prev_out_cm _el_prev_out_cm_saved _el_prev_sbInfo_saved _el_prev_size _el_previous_history _el_print _el_print_string _el_prompt _el_prompt_len _el_remove_tail_spaces _el_replace_char _el_set_cursor _el_signal_handler _el_temp_print _el_temp_print_size _el_text _el_text_mb _el_w2mb _el_wide _el_write_history_helper add_history append_history clear_history current_history free_history free_history_entry history_get history_length history_list history_set_pos history_truncate_file next_history previous_history read_history readline remove_history replace_history_entry rl_attempted_completion_function rl_attempted_completion_over rl_basic_word_break_characters rl_completer_word_break_characters rl_completion_append_character rl_completion_entry_function rl_completion_matches rl_end rl_filename_completion_function rl_free rl_library_version rl_line_buffer rl_point rl_prompt rl_readline_name rl_readline_version rl_user_completion_entry_free_function source_editrc using_history where_history write_history