d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98.dll
Size 1.2MB
Sample260703-mbzyjsft2x
SHA256 d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98
MD5 69583a112e0e031fb720690b32a66e8f
SHA1 df8154983550f58eea2b6af425c7af5ef887b963
SHA512 0dfdf72068489b2acde48755c70a3df47dd5d42dca7bd915ac03ad07f9712e6a1db0eccd2670c423331af68cc15f85bb4e77059751bbf60bbf972f060a4d0c05
SSDEEP 12288:mp6U27aMvvW46Ww/z9t3Dkn22pQMVZkbqD349fFcjCt8AHULebUJ:mp6r7aMv4/z9tWxSqD349fKjCjlbUJ
TLSH
T162454B03E695B4EAC45DC03883579536BE72BC8D4731B6EB2BD86A343E67B906B1D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98.dll

File Explorer

d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98.dll

.dll 1.2MB

d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98.dll

IMPHASH 3c4913e2b3acd30f8ca9f1a7ab8437a1
SHA256 d4d240c6291c7c15c745e87a2ff723122edc7f2be20a4fd78d18fb581ce34f98
MD5 69583a112e0e031fb720690b32a66e8f
SHA1 df8154983550f58eea2b6af425c7af5ef887b963
SHA512 0dfdf72068489b2acde48755c70a3df47dd5d42dca7bd915ac03ad07f9712e6a1db0eccd2670c423331af68cc15f85bb4e77059751bbf60bbf972f060a4d0c05
SSDEEP 12288:mp6U27aMvvW46Ww/z9t3Dkn22pQMVZkbqD349fFcjCt8AHULebUJ:mp6r7aMv4/z9tWxSqD349fKjCjlbUJ
TLSH
T162454B03E695B4EAC45DC03883579536BE72BC8D4731B6EB2BD86A343E67B906B1D304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

816976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

srvhost_dll.pdb

kernel32

GetProcessHeap SetFileInformationByHandle GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP GetSystemTimePreciseAsFileTime WriteConsoleW HeapAlloc DeleteFileW ReadFileEx SleepEx WriteFileEx GetLogicalDrives GetVersionExW CreateThread GetCurrentThread SetThreadStackGuarantee GetFullPathNameW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx TerminateProcess ExitProcess CreateEventW CancelIo GetOverlappedResult GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW HeapReAlloc DuplicateHandle ReadFile WaitForMultipleObjects GetExitCodeProcess FindFirstFileExW PeekNamedPipe CreateWaitableTimerExW SwitchToThread HeapFree PostQueuedCompletionStatus IsProcessorFeaturePresent DisableThreadLibraryCalls DeleteProcThreadAttributeList GetSystemTimeAsFileTime SetLastError CreateProcessW GetFinalPathNameByHandleW UpdateProcThreadAttribute GetQueuedCompletionStatusEx CreateIoCompletionPort InitializeProcThreadAttributeList GlobalMemoryStatusEx GetSystemInfo GetComputerNameExW SetHandleInformation CreatePipe GetProcAddress GetModuleHandleA OpenProcess Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerW GetCurrentProcessId VirtualProtect GetCurrentProcess UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateFileW GetModuleHandleW GetLastError FindClose FindNextFileW GetModuleFileNameW SetFileCompletionNotificationModes CloseHandle GetEnvironmentStringsW QueryPerformanceCounter FreeEnvironmentStringsW QueryPerformanceFrequency GetEnvironmentVariableW RtlVirtualUnwind CompareStringOrdinal InitializeSListHead FormatMessageW SetUnhandledExceptionFilter WideCharToMultiByte lstrlenW RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW MultiByteToWideChar CreateToolhelp32Snapshot UnhandledExceptionFilter Process32NextW ProcessIdToSessionId Process32FirstW IsDebuggerPresent

advapi32

GetTokenInformation SystemFunction036 OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges LookupAccountSidW GetUserNameW RegOpenKeyExW RegQueryValueExW RegCloseKey

ws2_32

shutdown WSASocketW closesocket setsockopt getsockopt bind WSAStartup WSACleanup getaddrinfo WSASend WSAIoctl freeaddrinfo recv send gethostname getsockname WSAGetLastError getpeername ioctlsocket connect

netapi32

NetUserEnum NetApiBufferFree NetShareEnum

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtReadFile NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile NtCreateFile NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

crypt32

CertOpenStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertGetCertificateChain CertFreeCertificateContext

secur32

EncryptMessage DeleteSecurityContext DecryptMessage FreeContextBuffer AcceptSecurityContext ApplyControlToken InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleA FreeCredentialsHandle

bcryptprimitives

ProcessPrng

iphlpapi

GetAdaptersAddresses

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject SetStretchBltMode StretchBlt GetDIBits DeleteObject DeleteDC

vcruntime140

__std_type_info_destroy_list memmove __C_specific_handler memset __CxxFrameHandler3 memcmp memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _cexit _execute_onexit_table _initialize_onexit_table _initterm _initterm_e _seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free