libEGL[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
libEGL.dll
Size 324KB
Sample260628-ajvmkses8v
SHA256 e9d7a6126eab94751e33ad65e1f23431afc0e790262ddec4781abef16c31e033
MD5 cfe37ad4afcf81f2bfa61bf39f9bc8d6
SHA1 4662b39c9bf13efe8d22e1ea7519dbfbc5057f15
SHA512 ce8ae577a6bfde7de1a0d204397ffd4bef43786c6c09638e91e6608721bb5ecb4bf7ca80c893ed4a5f2189d77b1dd7479411b7303264f1c5e815db16bf439dbf
SSDEEP 6144:2k8G0kKDvNIFHDs3KQlITFq57NwBH62g34Vh++hyHY7F3HPgipSSYy:X8G0VzNIFcKQlB66Qh++hyHoplpS
TLSH
T1AC648E01B980C036D15E11307528E7794E7EBE610FA1D9CBDB989AED9FB02C05A357AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libEGL.dll

File Explorer

libEGL.dll

.dll 324KB

libEGL.dll

IMPHASH b7c0ca2c7eadf6e169e6d987180f93a8
SHA256 e9d7a6126eab94751e33ad65e1f23431afc0e790262ddec4781abef16c31e033
MD5 cfe37ad4afcf81f2bfa61bf39f9bc8d6
SHA1 4662b39c9bf13efe8d22e1ea7519dbfbc5057f15
SHA512 ce8ae577a6bfde7de1a0d204397ffd4bef43786c6c09638e91e6608721bb5ecb4bf7ca80c893ed4a5f2189d77b1dd7479411b7303264f1c5e815db16bf439dbf
SSDEEP 6144:2k8G0kKDvNIFHDs3KQlITFq57NwBH62g34Vh++hyHY7F3HPgipSSYy:X8G0VzNIFcKQlB66Qh++hyHoplpS
TLSH
T1AC648E01B980C036D15E11307528E7794E7EBE610FA1D9CBDB989AED9FB02C05A357AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123473

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libEGL.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlUnwind SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

GetClientRect GetDC IsWindow ReleaseDC

gdi32

GetDeviceCaps

Name

.text

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

246B

Characteristics

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

libEGL.dll

kernel32

user32

gdi32

generic