dogshit[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dogshit.dll
Size 1.6MB
Sample260523-246dcsby5r
SHA256 77bbc882f1ea676b7b452a2d741bdac581c90a97864cb3b959a4e2a250d3970b
MD5 3860e09be2c495eb7e96f22f19717703
SHA1 ebadf215c480c1a0cc992b5b68cfb0be60f2dc61
SHA512 0dfb42632d954a9a8cf9a000330347418ad43ce7a6d5999fa6ebc1e80941403aa123d2695fdda42d7c924bca65c14e5226f7f8cb36dbbbb99b97691d7c79201f
SSDEEP 24576:GL6V/SIRU2ZH9RluTHsFj4SqrgwaZsb+X6UFIoZunoVb:GAzRUIH9RYDsJ4Ewaeb+X6O
TLSH
T10B752A17E6A295ECC57BD0748767A732F970B85E40347E2E2B94DB311F20E60972EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dogshit.dll

File Explorer

dogshit.dll

.dll 1.6MB

dogshit.dll

IMPHASH fd587e532ffdeb07d60a4ccce42d574d
SHA256 77bbc882f1ea676b7b452a2d741bdac581c90a97864cb3b959a4e2a250d3970b
MD5 3860e09be2c495eb7e96f22f19717703
SHA1 ebadf215c480c1a0cc992b5b68cfb0be60f2dc61
SHA512 0dfb42632d954a9a8cf9a000330347418ad43ce7a6d5999fa6ebc1e80941403aa123d2695fdda42d7c924bca65c14e5226f7f8cb36dbbbb99b97691d7c79201f
SSDEEP 24576:GL6V/SIRU2ZH9RluTHsFj4SqrgwaZsb+X6UFIoZunoVb:GAzRUIH9RYDsJ4Ewaeb+X6O
TLSH
T10B752A17E6A295ECC57BD0748767A732F970B85E40347E2E2B94DB311F20E60972EB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

comdlg32

GetOpenFileNameW

crypt32

CryptBinaryToStringA CryptStringToBinaryA

gdi32

CreateBitmap DeleteObject

kernel32

AllocConsole AttachConsole CloseHandle CopyFileW CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitProcess ExitThread ExpandEnvironmentStringsW FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindNextFileW FindResourceA FindResourceExW FindResourceW FormatMessageA FreeConsole GetConsoleMode GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleTitleW SetCurrentDirectoryW SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

ntdll

RtlAddFunctionTable

ole32

CoInitializeEx

shell32

SHCreateDirectoryExW ShellExecuteA

shlwapi

PathFileExistsW PathRemoveFileSpecW

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbsrtowcs strtol strtoll strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file _wremove

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen fmod

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_assert _beginthreadex _endthreadex _errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _pclose _read _setmode _wfopen _wpopen _write fclose fflush fgetws fopen fputc fputs fread freopen fwrite getc getchar getwc putc putchar putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup isalnum isspace iswctype memset strcmp strcoll strcpy strlen strncmp strncpy strnlen strxfrm tolower towlower towupper wcscat wcscoll wcscpy wcslen wcsncpy wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

user32

CreateIconIndirect MessageBoxA SendMessageA SetForegroundWindow ShowWindow

winhttp

WinHttpCrackUrl

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dogshit.dll

comdlg32

crypt32

gdi32

kernel32

ntdll

ole32

shell32

shlwapi

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

winhttp

generic