g2m[.]dll | Triage™

General

Target
g2m.dll
Size 399KB
Sample260309-ex8htahs2j
SHA256 93439fe9b45d7b6e9fcdc5e68fd47677ea17025e4eabb6f1468cb9ae98ee8a5b
MD5 326683813b145cc5469dff1f77c701e3
SHA1 b31eb0e91c6e70719a15dd61e7e374ce2b7782c1
SHA512 981bf18aa03259a557eed4fc336d27f3f55b3a0421e70b6b59c5ef9753be885b537d5e55f2d58753621b57aa6079708d35732edddd4d97d4891b79600e631fc3
SSDEEP 6144:u9rSWpovUahUzo+NY7+c2wkYUL8NuS3ZCXfrUNfu:u9TpofojwjUL8IJ8
TLSH
T18F945B03F68180B7E61F0135229F9B656EFEA5106392CEDBC3F009B85E767D25B32958
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
g2m.dll

File Explorer

g2m.dll

.dll 399KB

g2m.dll

IMPHASH f86ae2df15d743de85c724c15b1dad25
SHA256 93439fe9b45d7b6e9fcdc5e68fd47677ea17025e4eabb6f1468cb9ae98ee8a5b
MD5 326683813b145cc5469dff1f77c701e3
SHA1 b31eb0e91c6e70719a15dd61e7e374ce2b7782c1
SHA512 981bf18aa03259a557eed4fc336d27f3f55b3a0421e70b6b59c5ef9753be885b537d5e55f2d58753621b57aa6079708d35732edddd4d97d4891b79600e631fc3
SSDEEP 6144:u9rSWpovUahUzo+NY7+c2wkYUL8NuS3ZCXfrUNfu:u9TpofojwjUL8IJ8
TLSH
T18F945B03F68180B7E61F0135229F9B656EFEA5106392CEDBC3F009B85E767D25B32958
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

168116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\rust-dave-sideload\target\i686-pc-windows-msvc\release\deps\rust_dave_sideload.pdb

kernel32

GetEnvironmentVariableW VirtualAlloc CloseHandle GetModuleHandleA GetProcAddress ReleaseSRWLockExclusive AcquireSRWLockExclusive GetNativeSystemInfo VirtualQuery VirtualFree VirtualProtect GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile GetCurrentProcess GetLastError FindNextFileW FindClose CreateFileW SetFileInformationByHandle FlushFileBuffers GetFileInformationByHandle GetFileInformationByHandleEx SetFilePointerEx InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree TlsGetValue TlsSetValue AcquireSRWLockShared ReleaseSRWLockShared CreateThread SetThreadStackGuarantee GetCurrentThread WaitForSingleObject CreateWaitableTimerExW SetWaitableTimer Sleep SetHandleInformation GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW WideCharToMultiByte ReadConsoleW SetLastError ReadFile GetCurrentProcessId QueryPerformanceCounter ReleaseMutex RtlCaptureContext FreeEnvironmentStringsW GetEnvironmentStringsW WaitForSingleObjectEx LoadLibraryA CreateMutexA HeapFree HeapReAlloc GetModuleHandleW FormatMessageW ExitProcess GetProcessHeap HeapAlloc GetCurrentDirectoryW DecodePointer GetFullPathNameW GetModuleFileNameW GetSystemTimeAsFileTime GetCommandLineW GetFileType TerminateProcess HeapSize GetStringTypeW SetStdHandle GetConsoleOutputCP WriteFile GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW GetModuleHandleExW LoadLibraryExW FreeLibrary InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList RaiseException RtlUnwind IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThreadId InitializeSListHead IsDebuggerPresent

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

ws2_32

WSAGetLastError WSACleanup WSAStartup listen bind freeaddrinfo getaddrinfo closesocket WSASocketW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

Sharing