PhasmophobiaExt[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
PhasmophobiaExt.dll
Size 856KB
Sample260418-cgtzdaey21
SHA256 09335cadfdf5e5052bb60155252ee60bf5956959e27bd6808a67d9d555c56245
MD5 eaf4336a5d15b3bf3cab1604e8bfd144
SHA1 c39f342ffdefa485547842a88db72ecb267bb4fa
SHA512 94facbdb0cb4a90915c98f4c03e10adefe670c565008ca01dd20cef66c81a0430c1bdcbc7dc48285c3435dac2f5e4e3e6d17b8fdac054166d9757a60df150683
SSDEEP 24576:udXUzeryJMh7EM3S5jNMWh0lhSMXlFPiUn:uv7E1JMjwUn
TLSH
T19515BF42F7E881FDD02A9138CA976A0BEB727815076046DB23E445A93FA37F0577E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PhasmophobiaExt.dll

File Explorer

PhasmophobiaExt.dll

.dll 856KB

PhasmophobiaExt.dll

IMPHASH d4fea207468741f863229f6b8f273b1e
SHA256 09335cadfdf5e5052bb60155252ee60bf5956959e27bd6808a67d9d555c56245
MD5 eaf4336a5d15b3bf3cab1604e8bfd144
SHA1 c39f342ffdefa485547842a88db72ecb267bb4fa
SHA512 94facbdb0cb4a90915c98f4c03e10adefe670c565008ca01dd20cef66c81a0430c1bdcbc7dc48285c3435dac2f5e4e3e6d17b8fdac054166d9757a60df150683
SSDEEP 24576:udXUzeryJMh7EM3S5jNMWh0lhSMXlFPiUn:uv7E1JMjwUn
TLSH
T19515BF42F7E881FDD02A9138CA976A0BEB727815076046DB23E445A93FA37F0577E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

391932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\matvey\Documents\Проекты\PhasmophobiaExt\x64\Release\PhasmophobiaExt.pdb

kernel32

CreateThread GetLocalTime GetProcAddress GetCurrentProcessId GetModuleHandleW WideCharToMultiByte SetConsoleOutputCP AllocConsole SetUnhandledExceptionFilter OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter WriteConsoleW SetEndOfFile HeapSize CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FreeConsole GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx GetConsoleOutputCP WriteFile FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CloseHandle DisableThreadLibraryCalls CreateFileA Sleep LoadLibraryExW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetModuleFileNameW MultiByteToWideChar GetModuleHandleA GetCurrentThreadId GetCurrentProcess FreeLibraryAndExitThread GetCommandLineA GetModuleFileNameA GetModuleHandleExW TerminateProcess ExitProcess IsProcessorFeaturePresent HeapCreate VirtualProtect HeapFree Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot GetLastError HeapReAlloc HeapAlloc HeapDestroy GetThreadContext FlushInstructionCache SetThreadContext OpenThread VirtualFree VirtualAlloc GetSystemInfo VirtualQuery GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo WakeAllConditionVariable GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ReadFile

user32

GetWindowLongPtrA FindWindowA GetForegroundWindow CallWindowProcA GetAsyncKeyState IsWindow SetWindowLongPtrA CreateWindowExA DestroyWindow DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

shell32

ShellExecuteW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

dbghelp

MiniDumpWriteDump

shlwapi

PathRemoveFileSpecA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

542KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PhasmophobiaExt.dll

kernel32

user32

shell32

d3d11

dxgi

dbghelp

shlwapi

imm32

d3dcompiler_47

generic