894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3[.]dll

General

Target
894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3.dll
Size 227KB
Sample260703-m4llmacw6l
SHA256 894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3
MD5 b07c3a3c73278a9622aa15900cf4834b
SHA1 c37955f96e07040c53b5866dddb508f5826e9799
SHA512 37992a9f38e6d339510458443e315017c15288d4df9ed2a2c07e44c27bd58cf2ef9a94a413583fbde38f5e50de7adcd60e3d6268806137ae655b32c9946c02f2
SSDEEP 3072:bZBef8XT6p4NLVH3PLmxph3PkvJOjgQEU9hteg6ZpxjiV5+f8I0ZEn:dBef8D6yNLVHCZcYjzEKmtZT8bC
TLSH
T1F9347C11AAA80CBEEE7795B8C9531902DA727C460360EDDF03904DA25F2F7E5963FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3.dll

File Explorer

894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3.dll

.dll 227KB

894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3.dll

IMPHASH b304ac3c6e6925b9c4f77db77a063113
SHA256 894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3
MD5 b07c3a3c73278a9622aa15900cf4834b
SHA1 c37955f96e07040c53b5866dddb508f5826e9799
SHA512 37992a9f38e6d339510458443e315017c15288d4df9ed2a2c07e44c27bd58cf2ef9a94a413583fbde38f5e50de7adcd60e3d6268806137ae655b32c9946c02f2
SSDEEP 3072:bZBef8XT6p4NLVH3PLmxph3PkvJOjgQEU9hteg6ZpxjiV5+f8I0ZEn:dBef8D6yNLVHCZcYjzEKmtZT8bC
TLSH
T1F9347C11AAA80CBEEE7795B8C9531902DA727C460360EDDF03904DA25F2F7E5963FB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptGetProperty BCryptOpenAlgorithmProvider

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegDeleteTreeA

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetStdHandle SetFilePointerEx GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage CreateFileW WriteConsoleW GetProcessHeap FlsAlloc GetSystemDirectoryA DisableThreadLibraryCalls GetModuleFileNameA GetProcAddress LoadLibraryA CreateFileA DeleteFileA ReadFile SetFilePointer WriteFile CloseHandle Sleep CreateThread GetCurrentThreadId GetLocalTime GetModuleHandleA MoveFileExA GetComputerNameA FindNextFileW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedFlushSList GetLastError SetLastError FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW CompareStringW LCMapStringW HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW

Name

.text

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

894ff69fc0953ed203ec952ab8955dc70d21563cc8556272a6db612133b9a1e3.dll

winhttp

bcrypt

advapi32

kernel32

generic