_27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
_27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b.dll
Size 6.7MB
Sample260520-nld99sb19x
SHA256 27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b
MD5 b333e2a52b1ee49397aca23308317a81
SHA1 0dc3804bc055101c011045bdcec6238ba0b99136
SHA512 7b93a9a3f350969776bd7e836aaee5791b795c4334e83c585a6d507039348cda437f15af045ca3783dc97a0acf89d202420a4f77bbd3046d1fa13d9d5d72a93e
SSDEEP 98304:l1zqRKGtSftKKTeQbVhFVgZARGNBsr0u2/Y1rln5dYS:WTjSeQbVhPZR3Ix/YPnZ
TLSH
T1D6668C0AB7D80664D562C630D62FD732C6BAFC554632C34F2918F3CA2E37B518F6A625
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b.dll

File Explorer

_27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b.dll

.dll 6.7MB

_27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b.dll

IMPHASH 93baec14f99c0024c7e8158a021b993f
SHA256 27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b
MD5 b333e2a52b1ee49397aca23308317a81
SHA1 0dc3804bc055101c011045bdcec6238ba0b99136
SHA512 7b93a9a3f350969776bd7e836aaee5791b795c4334e83c585a6d507039348cda437f15af045ca3783dc97a0acf89d202420a4f77bbd3046d1fa13d9d5d72a93e
SSDEEP 98304:l1zqRKGtSftKKTeQbVhFVgZARGNBsr0u2/Y1rln5dYS:WTjSeQbVhPZR3Ix/YPnZ
TLSH
T1D6668C0AB7D80664D562C630D62FD732C6BAFC554632C34F2918F3CA2E37B518F6A625
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

414208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW EventWrite EventRegister EventEnabled OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGetProperty BCryptExportKey BCryptGenRandom BCryptDestroyKey

crypt32

CertNameToStrW CryptDecodeObject CryptFormatObject CryptFindOIDInfo CryptImportPublicKeyInfoEx2 CertCloseStore CertControlStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertGetCertificateContextProperty CertGetNameStringW CertFreeCertificateContext CertOpenStore

kernel32

TlsGetValue TlsSetValue TlsFree TlsAlloc InitializeCriticalSectionAndSpinCount CloseThreadpoolIo SetLastError SetThreadErrorMode GetLastError MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime LoadLibraryExW GetSystemTime GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetFileAttributesExW GetFullPathNameW GetLongPathNameW GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP WriteFile GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileInformationByHandleEx GetFileType GetOverlappedResult SetFileInformationByHandle DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation CloseHandle SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW GetModuleHandleW FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualQuery DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ncrypt

NCryptDeleteKey NCryptOpenStorageProvider NCryptImportKey NCryptOpenKey NCryptGetProperty NCryptSetProperty NCryptFreeObject

ole32

CoWaitForMultipleHandles CoTaskMemAlloc CoTaskMemFree CoGetApartmentType CoUninitialize CoCreateGuid CoInitializeEx

api-ms-win-crt-math-l1-1-0

modf pow ceil

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh calloc

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncmp _wcsicmp strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e abort terminate _cexit _execute_onexit_table _initterm _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _seh_filter_dll

0u2xwsN4Tq08Z3VBJe6ahy 1C7JAPaCLsXjv 21bYjXEnIxhbC8IjvSvCCkSLFBeGqKR 2T3Vjfy 49ug48bd9hMgUKJhQJaBFM6kG 4Wy8yKECz7 53iQaimwpa8WfrndCPltBE4cM 5Z2G8LZUhDL3oD6QtMu 5ZhGhVvr1iylG2S3YIPzA 5sWBVfnUTECDlHRkKvOPjwsT3Fae 7f1VitEL5DX7GOJjDgqqRjszvsyTn 7qH8JBIxrb63RvCTP6SyEh1w 8JzAUmy6KwN6J5Y5T 8KNLOWqOyrZXysH57c6 8nxzgDAcVVg9mTBy3Qxe4OV6swo17 97m8oAs2wy 9R7cFOSZq 9VvxhVfm6sUO 9gMBLeDd 9v6O1v26FS5f A7st3BNM3hrHRDN0Upbk6 ABi5NjHMaKf09hGI AoGjXBdnvFLHER As4Yn8GysfNyWrHDo1h BiA5PMGQ BqrujXASmqNx2LIqTTs CLRCreateInstance CVUonkgpIVt0FjgC5dRu CallFunctionShim Cf5X6auDTPTc26lDmy CloseCtrs ClrCreateManagedInstance CoEEShutDownCOM CoInitializeCor CoInitializeEE CoUninitializeCor CoUninitializeEE CollectCtrs CorBindToCurrentRuntime CorBindToRuntime CorBindToRuntimeByCfg CorBindToRuntimeByPath CorBindToRuntimeByPathEx CorBindToRuntimeEx CorBindToRuntimeHost CorDllMainWorker CorExitProcess CorGetSvc CorIsLatestSvc CorMarkThreadInThreadPool CorTickleSvc CreateConfigStream CreateDebuggingInterfaceFromVersion CreateInterface DVlzvimfFS977l2iEI7wUsEKXzxUB DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer Dm4Qaiwp5gvbvZ2q2Qq7Xo E9SRQwrDfkRFIQNAKRT0kHKDOh5X EEDllGetClassObjectFromClass EEDllRegisterServer EEDllUnregisterServer FQeHwTnYy0crrHJQiBtZSqyv922 GQXj7LJUre0 Gb4hPMl6JzqZiA18MqG GetAssemblyMDImport GetCLRMetaHost GetCORRequiredVersion GetCORRootDirectory GetCORSystemDirectory GetCORVersion GetCompileInfo GetFileVersion GetHashFromAssemblyFile GetHashFromAssemblyFileW GetHashFromBlob GetHashFromFile GetHashFromFileW GetHashFromHandle GetHostConfigurationFile GetMetaDataInternalInterface GetMetaDataInternalInterfaceFromPublic GetMetaDataPublicInterfaceFromInternal GetPermissionRequests GetPrivateContextsPerfCounters GetProcessExecutableHeap GetRealProcAddress GetRequestedRuntimeInfo GetRequestedRuntimeVersion GetRequestedRuntimeVersionForCLSID GetStartupFlags GetTargetForVTableEntry GetTokenForVTableEntry GetVersionFromProcess GetXMLElement GetXMLElementAttribute GetXMLObject HD3YxK1w HllEcNBhamBn8djfyWOno HsseJ7Ykb6yVa7Et9rgnDoTe IEE InitErrors InitSSAutoEnterThread JFZsy62NcNf4H9MzILdtwofQ0rT7QDgO KvnMkg5WGBNzjebqrBON LoadLibraryShim LoadLibraryWithPolicyShim LoadStringRC LoadStringRCEx LockClrVersion LogHelp_LogAssert LogHelp_NoGuiOnAssert LogHelp_TerminateOnAssert LxB551xbFjob21zwgRDbXjfN MVRXYWBnk MetaDataGetDispenser MonXNn1nmNhHB03 N9AckTs8OTlz1c8Sj ND_CopyObjDst ND_CopyObjSrc ND_RI2 ND_RI4 ND_RI8 ND_RU1 ND_WI2 ND_WI4 ND_WI8 ND_WU1 Nqocg1tavMYtweZbiz Nwu6KAFITiJ8a OfJCz8AMH OpenCtrs PEW7wSkFLoQVicsYrwxHDg PUdQd8xzyNHEuDcDjbcaIdQRdWJ Pj6YDsF5QP58n2U3TDGnWlEed9gxjFj PostError PqBMJaQ8vBJexU1BztX1Rxg Q8C7TJXIrcmpmuA QQvUxXICk6FS1QIefoaMjSuUxOPq7 QpdnooAtgvN QzvrUSQEXXvZj2n8JTMndigqNmf ReOpenMetaDataWithMemory ReOpenMetaDataWithMemoryEx RunDll32ShimW RuntimeOSHandle RuntimeOpenImage RuntimeReleaseHandle S2ZBl9tXrx264VTWsdMGfGSRu S8X9Lqa6 SEpGZkzewFPgJu8atH8mpvFm08ogoh SJbWt7kplvfrBtPaq0M0buXVhldYibz2 SetTargetForVTableEntry Sm70TQ8HsHFdzxmeA9vpfcyES StrongNameCompareAssemblies StrongNameErrorInfo StrongNameFreeBuffer StrongNameGetBlob StrongNameGetBlobFromImage StrongNameGetPublicKey StrongNameHashSize StrongNameKeyDelete StrongNameKeyGen StrongNameKeyGenEx StrongNameKeyInstall StrongNameSignatureGeneration StrongNameSignatureGenerationEx StrongNameSignatureSize StrongNameSignatureVerification StrongNameSignatureVerificationEx StrongNameSignatureVerificationFromImage StrongNameTokenFromAssembly StrongNameTokenFromAssemblyEx StrongNameTokenFromPublicKey TnsrxcXl5rhi TranslateSecurityAttributes UpdateError V1MrkAqcPFU4THeC16zRmTUtQ VooiWgPfc4XlHPQq9ZEE18YiY WebgkSe X1s1iq2 Y0jLZ731fnJ3ZoV YEzshlnt6t532uX9qvgU9ycne YJ4Fw0kSVfHyLfD3R3swrmo YODM5HrBQohBY8cnN Yg8qpUwaPVVIvkWR8D aKxIm0H3eRJl0Jx bnrzyxIZMBPnMu1jES0c25DaaD bqdxchk5oSfDivYbfJRaMF6sXcB dXgpVlcGtkDrw eU3uMf9vlifOeXppExgwGHNXAJnVj fLVtuJkStwc6iip1HxJCUPRCKun0NXhA fQEYw1iScR13beILRAQmfyRM feWTv1cxy3qv2jQuXrin g0sWuVfvb gM7cyJsPL6ZO0H8EDyv0LpdK gRoh2YtoBEcPB6 hELeXAupsd5SfhEDO hpLQ5Om09xfQIvq22k1RuzwufGIECIVy jZl3KlyiWE0YvWRy k8b5jWDYcdKHKgXtSivp l6eIon0Tq2n9MC8Sn6lXBc lcZM6xG2OTz0qqVCC5Teoo8OOKiPZsw ldZxWbJ lwuSncBgTE2uTKfqN1gV7od lyOftCEi2PErGc8qEZh mCp0EcZ0jHfBwAjvoTKCVQE8 myXCKiyKl6F5yS5za9isTzy nLzRQYBTUqw3YBI nMkz67Mkr1hIK pbSk3Q6E6j ph41BdtnWrFFYduAaN pyq6Mo3Rn q1K8fjGIGZjfHd67TRgrTTgw4tRrU q3Pfy3RrW8aRfk8V547yHAyJ qOKJvIlM5AZiwbRZwVndPubQIqZ2vz qXdItEx2X2PwrdOVRE2E1jzgttgv r9y7uksMZI4hTpy6xVr ruDiZWGzjHrTbnt tlkQiYHoJtbpSBBjt udUoy2sunutn4eGOJwNNb4QxDh5 v7wqDbVKjFZgPF4ro3hFQlDyMYlZn7 vDBiWCMafbnAGyVq6Bzp5dJySf6qs vFxWvooN6cqxw1lGnkuZqjW wK7oL06 wUoEabW wtlWGbG8zYCN0 xSX3EhWmH6B4r6RIyQxLe4OF6 xc7YfSq xtSV8zPtWuIMrSp95kum y2ALeIbrUTsuQg6SXCpYPE4O6DVsRKs yH4oK3vT4ob3Z0oP9oTqW yofoe8IkEvMwjeMne zXCb5Q4WeWhmX8fivhk3imkZjnpa9 znreWxIMnSV3SahLp6fNdG zpqCG22V6lCAf9H

Name

.text

Size

427KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

881KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b.dll

advapi32

bcrypt

crypt32

kernel32

ncrypt

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic