Arsenic v1[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Arsenic v1.dll
Size 3.1MB
Sample260522-sd8alahs5s
SHA256 10e0f07df98304c2939150b059f51de51c7a61b08e41cd77932d0adf58dbde5c
MD5 85fa316ffe2ab0c46843fd1ddfb1ddfe
SHA1 bae6d6b59ac4fd755fd8eb1334e60ece4acbc745
SHA512 4fb24f6000959328c79da05e180731cb63dd25186943aa6e9746fb7260099016207467abbeccbc788427036a540eff39655c53ca5b64948b65ff10b77bc1ed1a
SSDEEP 49152:CjCv43u2ZlqDICuuZgqWggRbxCUly+9eFwFS0y/:CjGCgdWHRrawFS7
TLSH
T134E52A46B37A00E6C13DC134DA83B22AF9B13899877877EB97854E879F257E0917E704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Arsenic v1.dll

File Explorer

Arsenic v1.dll

.dll 3.1MB

Arsenic v1.dll

IMPHASH 2de9ace47e18a64d141eea2746ebf8fe
SHA256 10e0f07df98304c2939150b059f51de51c7a61b08e41cd77932d0adf58dbde5c
MD5 85fa316ffe2ab0c46843fd1ddfb1ddfe
SHA1 bae6d6b59ac4fd755fd8eb1334e60ece4acbc745
SHA512 4fb24f6000959328c79da05e180731cb63dd25186943aa6e9746fb7260099016207467abbeccbc788427036a540eff39655c53ca5b64948b65ff10b77bc1ed1a
SSDEEP 49152:CjCv43u2ZlqDICuuZgqWggRbxCUly+9eFwFS0y/:CjGCgdWHRrawFS7
TLSH
T134E52A46B37A00E6C13DC134DA83B22AF9B13899877877EB97854E879F257E0917E704
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1617480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject CreateEventA Sleep WaitForMultipleObjects OpenProcess K32GetModuleFileNameExA GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleA GetProcAddress VirtualQuery GetCommandLineA TerminateProcess FreeLibrary GetModuleFileNameW HeapReAlloc VirtualProtectEx ReadProcessMemory WriteProcessMemory CreateToolhelp32Snapshot Process32First Process32Next WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage DeleteFileW GetFileSizeEx ReadConsoleW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetStdHandle SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ExitProcess ReadFile HeapAlloc HeapDestroy GetLastError CloseHandle RaiseException GetCurrentProcessId DecodePointer RtlPcToFileHeader InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW LocalFree FormatMessageA CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent WaitForSingleObjectEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead HeapCreate Thread32Next Thread32First SuspendThread ResumeThread GetThreadContext SetThreadContext OpenThread GetSystemInfo OutputDebugStringW RtlUnwindEx InterlockedFlushSList LoadLibraryExW SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType RtlUnwind

user32

UnregisterClassA GetWindowThreadProcessId EnumWindows MessageBoxA DestroyWindow CreateWindowExA RegisterClassExA DefWindowProcA LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseCapture SetCapture GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrW MessageBoxW GetForegroundWindow GetSystemMetrics GetAsyncKeyState

shell32

SHGetFolderPathA

d3d12

D3D12SerializeRootSignature

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

786KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

337KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Arsenic v1.dll

kernel32

user32

shell32

d3d12

imm32

generic