_3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
_3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338.dll
Size 3.4MB
Sample260528-pl4etsfv3j
SHA256 3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338
MD5 dc70c7785354b6decd9350614a0aa72b
SHA1 88f5585cb7b399e4c0ac3b361c3186c64c1b0fda
SHA512 4b039bbca1433f83a6054e1e63de6f71309f9547c49d6d5a33ef2f35b8222277f551bf8de493734c7a8084bbf2637cbd8fe5040b78b7464b5db649c6744a179c
SSDEEP 49152:BOjPWjFIU6iuTKuk2r8iGJpWwAYzvcT0wZ5KoBi/a7IiO0u23KsheDo0PTayMt9O:G+yupTA2H2lEoR+mM4E
TLSH
T1E1F59D55E3A501D9D57AC13CCA578213EBB1B86453B0ABEF1DB086765F23BE1223EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338.dll

File Explorer

_3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338.dll

.dll 3.4MB

_3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338.dll

IMPHASH 0df6317e90b00c7d768274f466155d58
SHA256 3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338
MD5 dc70c7785354b6decd9350614a0aa72b
SHA1 88f5585cb7b399e4c0ac3b361c3186c64c1b0fda
SHA512 4b039bbca1433f83a6054e1e63de6f71309f9547c49d6d5a33ef2f35b8222277f551bf8de493734c7a8084bbf2637cbd8fe5040b78b7464b5db649c6744a179c
SSDEEP 49152:BOjPWjFIU6iuTKuk2r8iGJpWwAYzvcT0wZ5KoBi/a7IiO0u23KsheDo0PTayMt9O:G+yupTA2H2lEoR+mM4E
TLSH
T1E1F59D55E3A501D9D57AC13CCA578213EBB1B86453B0ABEF1DB086765F23BE1223EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2232292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

inet_ntoa inet_ntop closesocket WSASetLastError send recv WSAGetLastError WSACleanup

kernel32

AcquireSRWLockShared ReadFile QueryDosDeviceW GetFileSizeEx VirtualProtect VirtualFree GetCurrentProcess WriteFile K32GetMappedFileNameA SetFilePointer QueryDosDeviceA CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA GetCommandLineA GetLogicalDriveStringsW K32GetModuleFileNameExA GetLastError CreateFileA GetVersionExA CloseHandle GetSystemInfo GetLogicalDriveStringsA GetProcAddress CreateFileMappingA GetFileSize GetCurrentProcessId WideCharToMultiByte CreateDirectoryA GetSystemTime K32GetMappedFileNameW MapViewOfFile VirtualQuery RtlCaptureContext DuplicateHandle GetCurrentThread GetThreadContext SetThreadContext OpenThread K32GetProcessImageFileNameA OpenProcess CreateProcessW IsWow64Process VirtualQueryEx RtlRestoreContext OutputDebugStringA FormatMessageA LoadLibraryA MoveFileA GetFullPathNameA SetEndOfFile DeleteFileA CreateToolhelp32Snapshot VirtualProtectEx ReadProcessMemory K32EnumProcessModules InitializeCriticalSectionEx MultiByteToWideChar RaiseException DeleteCriticalSection GetSystemTimeAsFileTime FindFirstFileA FindNextFileA FindClose HeapCreate ReleaseSRWLockShared InitializeCriticalSection SetErrorMode AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlVirtualUnwind RtlAddFunctionTable RtlLookupFunctionEntry GetModuleHandleW Thread32Next Thread32First SuspendThread ResumeThread EnterCriticalSection FindNextFileW lstrlenW LeaveCriticalSection GetFileAttributesW GetFileAttributesA ExitThread FileTimeToSystemTime SystemTimeToFileTime GetProcessIdOfThread TryEnterCriticalSection GetVolumeInformationA GetVolumeNameForVolumeMountPointA GetTempPathA GetWindowsDirectoryA CreateEventA GetComputerNameA GetFullPathNameW GetLongPathNameW OpenMutexA LocalFree GetLongPathNameA CallNamedPipeW OpenEventA WaitForSingleObject Sleep SetEvent CreateThread ExitProcess HeapDestroy TlsSetValue TlsAlloc TlsGetValue TlsFree QueryPerformanceFrequency QueryPerformanceCounter GetStdHandle GetEnvironmentVariableW GetFileType SwitchToThread InitializeCriticalSectionAndSpinCount GetModuleHandleExW DeleteFiber ConvertFiberToThread FreeLibrary LoadLibraryW FindFirstFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FlsFree FlsSetValue FlsGetValue FlsAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive EncodePointer GetModuleFileNameW SetLastError InitOnceExecuteOnce HeapAlloc HeapReAlloc HeapFree CompareStringW LCMapStringW HeapSize GetConsoleOutputCP SetFilePointerEx SetStdHandle GetTimeZoneInformation FlushFileBuffers GetCurrentDirectoryW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW DecodePointer GetCommandLineW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler WriteConsoleW LoadLibraryExW InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx OutputDebugStringW InitializeSListHead UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlUnwind

user32

GetWindowThreadProcessId GetShellWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptReleaseContext CryptDestroyHash CryptCreateHash CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetKeyValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenProcessToken ConvertSidToStringSidW GetTokenInformation RegQueryValueExA GetUserNameA RegOpenKeyExA CloseServiceHandle OpenSCManagerW GetServiceKeyNameW QueryServiceConfigW RegCloseKey

ole32

CoCreateFreeThreadedMarshaler StringFromGUID2

oleaut32

SysStringLen

shlwapi

PathRemoveFileSpecA PathRemoveFileSpecW PathAppendA

bcrypt

BCryptGenRandom

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

770KB

Virtual Size

770KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

187KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338.dll

crypt32

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

bcrypt

generic