sirhurt[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sirhurt.dll
Size 3.9MB
Sample260328-2ebsfset2m
SHA256 aa8dd34346058cff1a95d24628720d2272ea96a1de640d4660aedca0ad53b5d9
MD5 21b8002f10ec4b7e70119c3ebe3ed856
SHA1 d6826369dfc3d6fc34005872127a75af5afc2540
SHA512 5362f9a7932b927abb108fc92e9aaa70df4c5c3841fdf8fd1dc17d8e7d7ac3c4c7173cdf2480bcd53f53519d491c7c16d84877be6525b66fbee778f45c00fec4
SSDEEP 49152:OhJtOyU7dEAVYfapfh/K7kBPUSTTk9cnhqUV9XsKhQuFg41NMnUC7zfiuVsyaexZ:rZEAskBPUSTTk9kMUVKhJPEuen
TLSH
T185167E89A6DDC0E8D576C0388A975603F7A27C4803389AFB0291DAB51F537F2767AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sirhurt.dll

File Explorer

sirhurt.dll

.dll 3.9MB

sirhurt.dll

IMPHASH ce1b48c3f31e28458e9b7da5b28e23ca
SHA256 aa8dd34346058cff1a95d24628720d2272ea96a1de640d4660aedca0ad53b5d9
MD5 21b8002f10ec4b7e70119c3ebe3ed856
SHA1 d6826369dfc3d6fc34005872127a75af5afc2540
SHA512 5362f9a7932b927abb108fc92e9aaa70df4c5c3841fdf8fd1dc17d8e7d7ac3c4c7173cdf2480bcd53f53519d491c7c16d84877be6525b66fbee778f45c00fec4
SSDEEP 49152:OhJtOyU7dEAVYfapfh/K7kBPUSTTk9cnhqUV9XsKhQuFg41NMnUC7zfiuVsyaexZ:rZEAskBPUSTTk9kMUVKhJPEuen
TLSH
T185167E89A6DDC0E8D576C0388A975603F7A27C4803389AFB0291DAB51F537F2767AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2810860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

a4nC6RC8VA21cPFHzSY0XPzGjq4d4IeC5Z4zcBCgezOhPvPbPpUWhdoSWDIskjlF7ssx1ahoVyVr4HvPWguE3vDom0j.pdb

shlwapi

PathFileExistsA

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFindCertificateInStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateChain

kernel32

QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter FormatMessageA SetEvent ResetEvent CreateEventA RaiseException GetLastError VirtualQuery GetCurrentProcess GetCurrentThreadId GetModuleHandleW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SetLastError FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType CreateDirectoryA PeekNamedPipe SleepEx VerifyVersionInfoW CreateFileW GetFileSizeEx GlobalAlloc InitializeCriticalSectionAndSpinCount CreateEventW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime GlobalMemoryStatusEx GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFilePointerEx SetFileInformationByHandle SetEndOfFile GetFullPathNameW GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW LocalFree FindNextFileW MultiByteToWideChar RemoveDirectoryA GlobalUnlock WideCharToMultiByte GlobalLock WaitForMultipleObjects GetCurrentProcessId GetWindowsDirectoryA GetSystemInfo CloseHandle Sleep FreeLibraryAndExitThread GetModuleFileNameA GetModuleHandleA DeleteFileA GetFileAttributesA FindClose FindNextFileA FindFirstFileA ReadFile

user32

RegisterClassExA UpdateWindow PostQuitMessage SetCursorPos TranslateMessage SetFocus CreateWindowExA DefWindowProcA EnumWindows MessageBoxA GetWindowTextA ShowWindow GetSystemMetrics CallNextHookEx SetWindowPos DestroyWindow LoadCursorA GetWindowRect DispatchMessageA GetMessageA GetWindowThreadProcessId SetClipboardData EmptyClipboard CloseClipboard OpenClipboard SendMessageA GetClientRect GetCursorPos GetForegroundWindow keybd_event MapVirtualKeyA SendInput GetMessageExtraInfo

gdi32

SetBkColor SetTextColor GetStockObject CreateFontA

advapi32

CryptDestroyHash CryptGenRandom CryptEncrypt CryptImportKey CryptDestroyKey CryptAcquireContextW RegCloseKey RegGetValueA RegQueryValueExA GetUserNameA RegOpenKeyExA CryptAcquireContextA CryptCreateHash CryptHashData CryptGetHashParam CryptReleaseContext

ws2_32

WSAWaitForMultipleEvents inet_ntop WSAEnumNetworkEvents bind getsockname socket WSAStartup htons setsockopt gethostname getpeername htonl getaddrinfo freeaddrinfo WSAEventSelect ntohs WSAIoctl inet_pton WSASetLastError WSACreateEvent recvfrom WSACloseEvent select __WSAFDIsSet WSACleanup WSAGetLastError recv send closesocket ioctlsocket connect listen WSAResetEvent accept sendto getsockopt

msvcp140

?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Strxfrm ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ ??0ctype_base@std@@QEAA@_K@Z ??1ctype_base@std@@UEAA@XZ _Toupper _Tolower ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Thrd_detach _Thrd_sleep ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_join _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit _Cnd_timedwait ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Mtx_current_owns _Cnd_destroy_in_situ ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?uncaught_exceptions@std@@YAHXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ _Xtime_get_ticks ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Cnd_init_in_situ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Throw_C_error@std@@YAXH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Cnd_signal

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __std_type_info_destroy_list __RTDynamicCast _CxxThrowException wcschr memcmp memmove memchr strrchr memset memcpy strchr __C_specific_handler strstr __std_type_info_name _purecall __std_type_info_compare __std_exception_destroy __std_exception_copy __std_terminate

api-ms-win-crt-heap-l1-1-0

_aligned_malloc _aligned_free realloc calloc free malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

__sys_errlist _errno _invalid_parameter_noinfo_noreturn _beginthreadex terminate strerror __sys_nerr _invalid_parameter_noinfo _initterm_e _initterm _cexit _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s _wopen fputs _fseeki64 ftell fread _read _write fopen _fileno _close fseek fgets fsetpos ungetc feof fputc _lseeki64 fflush fclose fgetc fwrite __stdio_common_vsprintf rewind _get_stream_buffer_pointers fgetpos __acrt_iob_func setvbuf _wfopen __stdio_common_vsscanf

api-ms-win-crt-filesystem-l1-1-0

_waccess _fstat64 _wstat64 _unlock_file _unlink _lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strncpy isalpha isspace strspn strcmp strncat wcsncpy wcspbrk isgraph isalnum isupper isxdigit iscntrl _strdup ispunct wcsncmp _wcsdup tolower strcspn strcpy_s isdigit islower strpbrk toupper strncmp

api-ms-win-crt-math-l1-1-0

cosh exp floor tanh modf _isnan _finite floorf fmod ceil cos ldexp round frexp atan2 log10 sin sinh ceilf atan asin log2 _fdopen acos _ldclass pow sqrt log sqrtf tan _dsign _fdclass _dclass _fdsign _ldsign

api-ms-win-crt-convert-l1-1-0

strtol strtoul atoi strtod strtoull wcstombs strtoll

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 _localtime64 strftime clock _difftime64 _localtime64_s _gmtime64_s

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func