_1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
_1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea.dll
Size 7.3MB
Sample260626-sfbpeact5s
SHA256 1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea
MD5 7ca47376b4699429c324acb9c371ea9b
SHA1 4a1b1f975499a2fff3668c9527cb5d85144f4930
SHA512 a198e400c68eea7a00ee8cc4c54b96069bf07d9a7cec80d9202bb3bf2a0a400f71b4a1baca78b03b37a8c1b62c50342e43b53fb8a956a912c45a61b27f6d1605
SSDEEP 98304:lNdwN/s9QjmxE6/0i1f0fRM+uh1kecu50qYCIHV1p6x0RxguP0yW:Xdwm+Z6/05ReKcRYVVrFP0yW
TLSH
T123768D367F805AA6C506C935B6379232C2A2B832F7E7818B7955D60B7E37B414E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea.dll

File Explorer

_1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea.dll

.dll 7.3MB

_1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea.dll

IMPHASH 109f73cc95228e3eacd82c151b1a5e6f
SHA256 1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea
MD5 7ca47376b4699429c324acb9c371ea9b
SHA1 4a1b1f975499a2fff3668c9527cb5d85144f4930
SHA512 a198e400c68eea7a00ee8cc4c54b96069bf07d9a7cec80d9202bb3bf2a0a400f71b4a1baca78b03b37a8c1b62c50342e43b53fb8a956a912c45a61b27f6d1605
SSDEEP 98304:lNdwN/s9QjmxE6/0i1f0fRM+uh1kecu50qYCIHV1p6x0RxguP0yW:Xdwm+Z6/05ReKcRYVVrFP0yW
TLSH
T123768D367F805AA6C506C935B6379232C2A2B832F7E7818B7955D60B7E37B414E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

789844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CreateEventExW CreateThread DuplicateHandle FormatMessageW FreeConsole GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetStdHandle GetThreadPriority GetTickCount64 LoadLibraryA LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ResumeThread SetEvent SetLastError SetThreadPriority Sleep VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread GetCurrentThreadId SuspendThread FlushProcessWriteBuffers GetThreadContext SetThreadContext GetSystemTimeAsFileTime CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW LoadLibraryExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead

ole32

CoWaitForMultipleHandles CoGetApartmentType CoUninitialize CoInitializeEx CoCreateGuid

api-ms-win-crt-math-l1-1-0

log ceil

api-ms-win-crt-heap-l1-1-0

free malloc calloc _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp strlen strcmp strcpy_s strcpy

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

terminate _cexit abort _seh_filter_dll _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e _initterm

1kxmhWiG7CTKCySgl5MnKQZFn33e4Q8 2UymtvVfKE00pt3 2piMRbuhHcA6wcgptEUx9JJN1AMpCgd 37m4pAkIB5JNihVRTxNSiF8 3Geafcz747Sm5dwXwoPfJJub 4cAsoRTLUrdrJad40BplAlcFTOO8 4hZbtrlsvjfydUvjRlCbesQ6c4 5JasfBscDU 6GkDZIrIYEVP5otGyWmeUyHGjw 7xF0zX0 9NkMfZjdVB Bz5JkNHiwCObytH5D5U EFlqb9U6ayra0IpIxb42oMouYF4 FTRwts9BuaQAp53T GetUtfMode JRArW9qMbOy KC93ruZluDlUEzrz2mMyjTpg L1NWFivmoJWILPaXdkVQEBJKegAnwN LookupStringInFixedSet MyR7sbcxF5H0 OjvTS99EcBZ0vLoo5a6xHizE5YHaAA9 PaGyKYXkF Qd9sIsMXljm5c0fPxwP1roJlkQ QiQEtMK7dYyqNK49kFSuA7XpUY4XIUo QrLDGmo R06AXWrMSmo7UC SOYhKBj STX2zF78zxi8PCEdrR UYvH9mvI V8Momd1jWYDynF75nBkbygDwnWtF VwFnaUW87BdkqvJm Vwy3ZCAFDKKUbNa X65ePuW7oTn XCzRkiabgxQOeg0BY1rEchdU969JG Xfpi3sDiNA8LeBxkthhDe9Ci YTI4Zvi8XZwAD7bpzN a78hu2FLDhKq3xRflEIHS c1xe3ogZy0qXw7s cT4dKAMKpIUJ90JgzPHON6gGCeU4 ciqvFnx4JcFr6vGv2qXIs6DdwQSJLg f8JbOMXGxh2 hv5fr8uQwyEkSeF9nBoj5igw4URbyA iI87A58n9Xp5IPdoj2GZQlTVcx1sQgtS iRWe5S9PpFdOZf6UwHb4FR0RT2uTsoAy j422ZIsgohcTe0 lIEfhTlM94ZMqXxFvFwp lianVNR6IfAWielnGb mT8p5O5Cd8Juabg5LElzrr mdjOVK0LiruVmJd n0slzxD91 nfXtTb8hWGLTGDKW12OBfQkB ns4phDwLYc1sHqWXkdpqpAuLXBf57N oElG9wlZj83vlzOIS4 p4XNSY3uJbsDb3VDMewhTMpEX94tjG pBO8TVF7t psl_builtin psl_builtin_file_time psl_builtin_filename psl_builtin_outdated psl_builtin_sha1sum psl_check_version_number psl_dist_filename psl_free psl_free_string psl_get_version psl_is_cookie_domain_acceptable psl_is_public_suffix psl_is_public_suffix2 psl_latest psl_load_file psl_load_fp psl_registrable_domain psl_str_to_utf8lower psl_suffix_count psl_suffix_exception_count psl_suffix_wildcard_count psl_unregistrable_domain q9zI2FxKONxCsKhkTdE9uQi qJS9ibzyvsapDZIKAJ5LzX2 s7XTlMQcvL sfu4a3ABDZi16kxNwC6NpcZFRP stzoJjx7kewjv t3JjZcgbs0pExITd9XGA1vFRk4BZ3xfx uFc0pAbwXFsEEpAoLwc0J2fjbyW6GPI uPxJDS1GFtDfsXu5lK20FTL6KWOsmBag uxZK1aq7Olx3FOX8Wkt6 uySBgKRmQORAmYX v1dDRK0UECwyRgtmsavDDwynLRUOGpBZ vdyba2mYUdlpFvZuSZUPSdik6 wUSHJkHdL wh2u0iGM9IYZAJoNZR04 x8DhAgh16nChW xWcoTPfuorNA3JXmPln xX5IkVLrthp4ymXz6rr7 zDj5oQFYz2hefpG3JjvXd3goJ5ntT zT87bzf3U zVnOJkYrtIy zX5iEaoEfy38NeB2VhNz zhI9HEklb7nNloFeYBWTMe7Maawsi zjB6oyO6jPApUvrqT6vcFtP6DhD zsjJ2ft