Sync[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Sync.dll
Size 1.0MB
Sample260603-b4le3sf14s
SHA256 55e11dc0029960941004002cb40d6cc6c7aa773b2d913fdfb78a8d4f33a410d1
MD5 f0dd59b18b49fcc0ccea9459e5e78a48
SHA1 eaee0f19a7c37a7f63e6088f6a263f844fe240a7
SHA512 f391f02a2fa82b14e023cb0b5c957a9312647989449fbbef9b1caf7295218cd78ffe527f0d31570c62437c7567f9832b6ed574207bc2f8f7b05dfc5b6f46cdd1
SSDEEP 12288:j3naEfjWRmI6p6fGGQMM0Bv/JX7tkrcNla+OK5g1XyjEaIlME1:j3d7WRmI6pgaYxXUulzOKiiqh
TLSH
T1F0259D0962E402EDF17BE675CA735503E2B178851270EA9F0BE0498E5F7B7605A3F326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Sync.dll

File Explorer

Sync.dll

.dll 1.0MB

Sync.dll

IMPHASH a086bb7c046270dd8e6a4cc4a2d2bb17
SHA256 55e11dc0029960941004002cb40d6cc6c7aa773b2d913fdfb78a8d4f33a410d1
MD5 f0dd59b18b49fcc0ccea9459e5e78a48
SHA1 eaee0f19a7c37a7f63e6088f6a263f844fe240a7
SHA512 f391f02a2fa82b14e023cb0b5c957a9312647989449fbbef9b1caf7295218cd78ffe527f0d31570c62437c7567f9832b6ed574207bc2f8f7b05dfc5b6f46cdd1
SSDEEP 12288:j3naEfjWRmI6p6fGGQMM0Bv/JX7tkrcNla+OK5g1XyjEaIlME1:j3d7WRmI6pgaYxXUulzOKiiqh
TLSH
T1F0259D0962E402EDF17BE675CA735503E2B178851270EA9F0BE0498E5F7B7605A3F326
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5c:52:83:a7:58:a8:52:93:60:52:ef:52:ae:a3:57:de:95:8c:c8:fa:44:71:fa:a0:41:89:50:50:b1:0c:ee:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Chains

May 28, 2026

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Serial Number

36:ea:f6:1d:c3:95:f6:30:41:f4:24:7d:ae:76:ab:7e

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2016 - Aug 12, 2018

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

548868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Mr Beast\Downloads\internal - Kopya\internal - Kopya\x64\Release\gooo\Sync.pdb

kernel32

CloseHandle Sleep CreateThread VirtualAlloc VirtualProtect DisableThreadLibraryCalls GetModuleHandleA GetProcAddress LoadLibraryW EnterCriticalSection LeaveCriticalSection GetTickCount GetTickCount64 VirtualQuery GlobalUnlock GlobalLock SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW DeleteCriticalSection GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage RtlUnwind

user32

CallNextHookEx GetCursorPos MapVirtualKeyW GetKeyNameTextA GetAsyncKeyState GetClipboardData CloseClipboard OpenClipboard

shell32

SHGetFolderPathA

winmm

PlaySoundW

Name

.text

Size

747KB

Virtual Size

746KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

223KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Sync.dll

PE Signature issue

kernel32

user32

shell32

winmm

generic