Kshwxb[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Kshwxb.dll
Size 1.8MB
Sample260620-qb8ggae17p
SHA256 5ba5dbab575a73dde2dfb27e53f91512e7242e1de95aeaba69fe20f68d325421
MD5 970ca4bcd94d691dd586e6f7031a9bd6
SHA1 27b9ab6e1c419ad456f9ca6e2b397ed4a9dc91a2
SHA512 153f2d0a870c95a88371faf544363730615346898a9298c856a544f677f32dcbc349207a6e84640a1967b5c553699d518f136b68c475209e79ceb6429cfd1e2c
SSDEEP 24576:LhIYXDDJ1OCV+g/LKNzQ4NBa0LDPTeCAVrH3XPqioPt1zxVqrnLJM92RY2L1Heh5:Li4RjRCBacaJM9MYg8sbsuY
TLSH
T141955C00EFD768BAE502173268FB539B2338D8090F369BC7EA547638B9776D11836716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Kshwxb.dll

File Explorer

Kshwxb.dll

.dll 1.8MB

Kshwxb.dll

IMPHASH e8c28134163fa189336ed64a759c7015
SHA256 5ba5dbab575a73dde2dfb27e53f91512e7242e1de95aeaba69fe20f68d325421
MD5 970ca4bcd94d691dd586e6f7031a9bd6
SHA1 27b9ab6e1c419ad456f9ca6e2b397ed4a9dc91a2
SHA512 153f2d0a870c95a88371faf544363730615346898a9298c856a544f677f32dcbc349207a6e84640a1967b5c553699d518f136b68c475209e79ceb6429cfd1e2c
SSDEEP 24576:LhIYXDDJ1OCV+g/LKNzQ4NBa0LDPTeCAVrH3XPqioPt1zxVqrnLJM92RY2L1Heh5:Li4RjRCBacaJM9MYg8sbsuY
TLSH
T141955C00EFD768BAE502173268FB539B2338D8090F369BC7EA547638B9776D11836716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8c:fc:9b:64:02:38:bd:26:4a:a9:30:55:06:86:45:f8:25:82:ef:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=sindimec.org.br,O=VgWkPDjfTtVTD,L=vAlw8,ST=yQATxSyoQ,C=US

Chains

Jun 19, 2026

CN=sindimec.org.br,O=VgWkPDjfTtVTD,L=vAlw8,ST=yQATxSyoQ,C=US

Minor OS version

Major OS version

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryExW LoadLibraryW MultiByteToWideChar PostQueuedCompletionStatus RaiseFailFastException ResumeThread SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__mb_cur_max _amsg_exit _errno _initterm _iob _lock _unlock abort atoi calloc fputc free fwrite localeconv malloc memcpy memset realloc setlocale strchr strerror strlen strncmp vfprintf wcslen

Name

.text

Size

546KB

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

919KB

Virtual Size

919KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

95B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kshwxb.dll

PE Signature issue

kernel32

msvcrt

generic