solaris[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
solaris.dll
Size 361KB
Sample260629-v3vrxaax5v
SHA256 446d92a50fdb78a29a5d2bf213ac5a24d8fe3b1bb4e8dbb4135c74ad6386c3e0
MD5 eb82b9d2b84cc712cdad3ddfcd128c12
SHA1 3a0cbbb85979f52e366cb1345bae384007aaa284
SHA512 be5b37796246ff192f31d7ca6d449c9befb73bf834190233143a68adc1b97761cb13a480998e1309f666cd6b2831185352efb00a5c4ef79e82e200dcd61d5580
SSDEEP 3072:RfMt3aeEzaFMupyZKvD+BTlXxhNZDLWu7Me5d1vUlcKtOj/uXnkzbMbXMHCAzmiF:leeZu6BtxhLWuQKjpPzboGdl3b
TLSH
T134746D29EAA4097CE1B79178CD375905D6727C8A0760AADF23A049A61F33FE4573E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
solaris.dll

File Explorer

solaris.dll

.dll 361KB

solaris.dll

IMPHASH b91dc6bb0eac3fcc0501c449c59c38fb
SHA256 446d92a50fdb78a29a5d2bf213ac5a24d8fe3b1bb4e8dbb4135c74ad6386c3e0
MD5 eb82b9d2b84cc712cdad3ddfcd128c12
SHA1 3a0cbbb85979f52e366cb1345bae384007aaa284
SHA512 be5b37796246ff192f31d7ca6d449c9befb73bf834190233143a68adc1b97761cb13a480998e1309f666cd6b2831185352efb00a5c4ef79e82e200dcd61d5580
SSDEEP 3072:RfMt3aeEzaFMupyZKvD+BTlXxhNZDLWu7Me5d1vUlcKtOj/uXnkzbMbXMHCAzmiF:leeZu6BtxhLWuQKjpPzboGdl3b
TLSH
T134746D29EAA4097CE1B79178CD375905D6727C8A0760AADF23A049A61F33FE4573E702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d2d1

ord1

dwrite

DWriteCreateFactory

user32

EnumWindows GetForegroundWindow MessageBoxA DefWindowProcW MapVirtualKeyW DestroyWindow GetDC CreateWindowExW ScreenToClient CallNextHookEx GetSystemMetrics RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW TrackMouseEvent UnhookWindowsHookEx TranslateMessage LoadCursorW SetCapture SetWindowsHookExW UpdateLayeredWindow GetKeyNameTextW PostQuitMessage ReleaseCapture ReleaseDC GetWindowThreadProcessId SetWindowTextW

gdi32

CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject SelectObject

ole32

CoCreateInstance

advapi32

RegEnumKeyExW RegOpenKeyExW RegCloseKey

kernel32

FlushFileBuffers SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP WriteFile FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetConsoleOutputCP GetConsoleMode HeapSize IsValidLocale GetLocaleInfoW CreateFileW WriteConsoleW IsValidCodePage VirtualProtect GetCurrentProcess WaitForSingleObject FreeLibraryAndExitThread GetModuleHandleA Sleep DisableThreadLibraryCalls CloseHandle K32GetModuleInformation CreateThread GetProcAddress GetCurrentProcessId FlushInstructionCache VirtualQuery GetModuleHandleW WideCharToMultiByte HeapCreate HeapFree Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot GetLastError HeapReAlloc HeapAlloc HeapDestroy GetThreadContext SetThreadContext OpenThread VirtualFree VirtualAlloc GetSystemInfo QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead LCMapStringW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW FlsAlloc FlsGetValue FlsSetValue FlsFree

Name

.text

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

solaris.dll

d2d1

dwrite

user32

gdi32

ole32

advapi32

kernel32

generic