echo vr auto pocket[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
echo vr auto pocket.dll
Size 511KB
Sample260628-klmd4ags3x
SHA256 109641a8ddfb738f2ebc1ebb29ccf14353d19c294e7db1f2dea3422aa05bc677
MD5 f621181443741aaf5449be461ff05321
SHA1 67c5174a1f2b726d2c9d531fdd5711dd7edcd708
SHA512 a3787dfa117ff6bcea637b80fcb609cb6b67a055bc4552ea30f85ab85efb7b95d48201a53e6b195db2e8b7e38f9663fc33ffac8bb3407a10a8b13339af4db7b7
SSDEEP 6144:kKdKr6gHECxW9YRfsuSyXLMIcj9m03SVkCDfrEOfY0XLAvnY+gaYM+NME:TdRgZU90UuSybM3m0ADfgOw0EvnY+ga
TLSH
T182B48D46F2A407F8D067907CA19BE61BF675348807148ADB33E449642FE37E16ABF361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
echo vr auto pocket.dll

File Explorer

echo vr auto pocket.dll

.dll 511KB

echo vr auto pocket.dll

IMPHASH 901dd07e5f344fe875c6de55b2a9f232
SHA256 109641a8ddfb738f2ebc1ebb29ccf14353d19c294e7db1f2dea3422aa05bc677
MD5 f621181443741aaf5449be461ff05321
SHA1 67c5174a1f2b726d2c9d531fdd5711dd7edcd708
SHA512 a3787dfa117ff6bcea637b80fcb609cb6b67a055bc4552ea30f85ab85efb7b95d48201a53e6b195db2e8b7e38f9663fc33ffac8bb3407a10a8b13339af4db7b7
SSDEEP 6144:kKdKr6gHECxW9YRfsuSyXLMIcj9m03SVkCDfrEOfY0XLAvnY+gaYM+NME:TdRgZU90UuSybM3m0ADfgOw0EvnY+ga
TLSH
T182B48D46F2A407F8D067907CA19BE61BF675348807148ADB33E449642FE37E16ABF361
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

409244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\dullf\Desktop\daim\Build\DirectX12 Demo (x64).pdb

kernel32

GetProcAddress CreateEventA QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep HeapReAlloc HeapAlloc GetThreadContext WideCharToMultiByte LoadLibraryA FlushInstructionCache SetThreadContext OpenThread FreeLibraryAndExitThread K32GetModuleFileNameExA DisableThreadLibraryCalls CreateThread GlobalLock InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CloseHandle GetModuleHandleA WaitForSingleObject GetModuleHandleW GlobalUnlock GlobalFree GlobalAlloc GetCurrentProcessId MultiByteToWideChar

user32

ReleaseCapture SetCursorPos IsChild GetWindowThreadProcessId GetWindowRect DestroyWindow GetClassNameA GetAsyncKeyState CallWindowProcA GetWindowTextA DefWindowProcA CreateWindowExA GetWindowLongPtrA UnregisterClassA SetWindowLongPtrA RegisterClassExA GetKeyState LoadCursorA GetClientRect GetCursorPos SetCursor OpenClipboard SetCapture CloseClipboard ClientToScreen SetClipboardData GetCapture ScreenToClient GetClipboardData EmptyClipboard GetForegroundWindow

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

msvcp140

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_function_call@std@@YAXXZ ?_Throw_C_error@std@@YAXH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Thrd_sleep _Thrd_id _Query_perf_counter _Xtime_get_ticks _Thrd_join _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset _CxxThrowException __std_type_info_destroy_list __current_exception_context __std_exception_destroy __C_specific_handler strstr __std_terminate __std_exception_copy __current_exception memmove memcpy memcmp memchr

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fgetpos fsetpos _fseeki64 ftell _get_stream_buffer_pointers fputc fflush __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fclose fseek fgetc

api-ms-win-crt-string-l1-1-0

strcmp strncpy

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh

api-ms-win-crt-convert-l1-1-0

atof strtod strtoll strtoull

api-ms-win-crt-math-l1-1-0

_dsign _dclass log2f _fdclass ceilf cosf expf fmodf powf sinf sqrtf acosf

api-ms-win-crt-runtime-l1-1-0

_initterm _cexit _crt_atexit terminate _initterm_e _errno _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _invalid_parameter_noinfo_noreturn _beginthreadex

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv