version[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.dll
Size 239KB
Sample260628-pkklbshs2x
SHA256 70553a2b4d53eddf1eeb290e346a9b562c71f52d46874bfb708e9d962469a736
MD5 b69243228b677fdacac06ce9365a4571
SHA1 95d0f75adc5cb2084ef022442b40a2d71f35dd5f
SHA512 4ea0f326298917269a13c8f83564c5e54a32d9d91f903dc2577c10722c3a289bf5d8ad7c826a7280d05c88f4d25c63550ca90d2a7b8a50cae64bf96c7bf96b24
SSDEEP 3072:MbBeHieiC4hRtKqgU8Md0aHN674LubHCZwtNtJHUSgUveq5tYDXDTsC1fxgKTu6b:meHieIhK6Yd71FJHUeNqa6wuHZWa
TLSH
T181343A4B72A408BAEC7B913999575E01F373B84A03B0D7DF03A0196A5F6B7E05D3A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 239KB

version.dll

IMPHASH aa817ee6ddb0763231772a96b512664c
SHA256 70553a2b4d53eddf1eeb290e346a9b562c71f52d46874bfb708e9d962469a736
MD5 b69243228b677fdacac06ce9365a4571
SHA1 95d0f75adc5cb2084ef022442b40a2d71f35dd5f
SHA512 4ea0f326298917269a13c8f83564c5e54a32d9d91f903dc2577c10722c3a289bf5d8ad7c826a7280d05c88f4d25c63550ca90d2a7b8a50cae64bf96c7bf96b24
SSDEEP 3072:MbBeHieiC4hRtKqgU8Md0aHN674LubHCZwtNtJHUSgUveq5tYDXDTsC1fxgKTu6b:meHieIhK6Yd71FJHUeNqa6wuHZWa
TLSH
T181343A4B72A408BAEC7B913999575E01F373B84A03B0D7DF03A0196A5F6B7E05D3A750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\GitHub\Origin DLC Unlocker\v2\EA DLC Unlocker v2 source\x64\Release\version.pdb

kernel32

GetLastError CreateThread GetPrivateProfileStringW GetPrivateProfileIntW Sleep GetModuleHandleW GetCurrentThread GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetSystemDirectoryW LoadLibraryW GetProcAddress FreeLibrary GetCommandLineW CreateDirectoryW CreateProcessA WaitForSingleObject CloseHandle CopyFileW WriteConsoleW SetEndOfFile HeapReAlloc HeapSize CreateFileW SetStdHandle GetStringTypeW GetFileSizeEx GetProcessHeap SetLastError GetCurrentProcess VirtualProtect VirtualQuery LoadLibraryExA LoadLibraryExW GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ReadFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetStdHandle GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW FlushFileBuffers WriteFile GetConsoleCP FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW

user32

MessageBoxW

shell32

SHFileOperationW

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile InternetGetLastResponseInfoA HttpQueryInfoA HttpQueryInfoW

Name

.text

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version.dll

kernel32

user32

shell32

wininet

generic