bot[.]dll | Triage™

Resubmissions

05/07/2026, 21:54

260705-1shx9abw9k

05/07/2026, 21:54

260705-1sbtyafy713

Sharing

Copy URL Twitter E-mail

General

Target
bot.dll
Size 160KB
Sample260705-1sbtyafy71
SHA256 673acbd681204f4a936225de3552eb9790710c9c610b93c4c569baedf9877bfd
MD5 6efdd9dcfaa7a377cdd67ba544b5d517
SHA1 54424f8fe939fb3734779ab71543a42569a37795
SHA512 baeef4d58787595cf5da04149926675a440b254979338afd1cc11762323a4168ee7bbb3921a60f4c4447f643e4d365947f9b51cd596db09c880f60d1615c3696
SSDEEP 3072:Nai+lVRwR5FqTnxiQ0xXNK0UXKL6i4e2xx6s/0v5s:NV+VRKW4HxE0gi6QyP/02
TLSH
T1D3F33B60B9585170C8AB527C941E7266D6AF9DB95FE192C32760E3EDECF03C16E3009B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

bot.dll

.dll 160KB

bot.dll

IMPHASH 569536065ee38a8a8186c7f4d18d6f82
SHA256 673acbd681204f4a936225de3552eb9790710c9c610b93c4c569baedf9877bfd
MD5 6efdd9dcfaa7a377cdd67ba544b5d517
SHA1 54424f8fe939fb3734779ab71543a42569a37795
SHA512 baeef4d58787595cf5da04149926675a440b254979338afd1cc11762323a4168ee7bbb3921a60f4c4447f643e4d365947f9b51cd596db09c880f60d1615c3696
SSDEEP 3072:Nai+lVRwR5FqTnxiQ0xXNK0UXKL6i4e2xx6s/0v5s:NV+VRKW4HxE0gi6QyP/02
TLSH
T1D3F33B60B9585170C8AB527C941E7266D6AF9DB95FE192C32760E3EDECF03C16E3009B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:10 windows x86 arch:x86

Digest

02:51:a6:52:2f:4e:28:e2:37:e0:ec:86:d1:ca:26:b6:7c:37:90:c4:36:20:0d:dc:b4:3c:f0:9a:ba:c4:fb:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2025 - May 6, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

109264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

vrfauto.pdb

msvcrt

_CxxThrowException ?what@exception@@UBEPBDXZ ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@ABQBDH@Z ??0exception@@QAE@ABQBD@Z _XcptFilter _callnewh _vsnwprintf wcstoul _wcsicmp memcmp ??1type_info@@UAE@XZ ??3@YAXPAX@Z calloc _amsg_exit _onexit memmove _initterm _except_handler4_common ?terminate@@YAXXZ _lock _unlock realloc __dllonexit _errno malloc memmove_s _purecall memcpy_s wcsncpy_s free wcscat_s _vsnprintf printf wcscpy_s ??_V@YAXPAX@Z __CxxFrameHandler3 memcpy memset

kernel32

GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep WideCharToMultiByte HeapDestroy GetProcessHeap HeapAlloc HeapFree SetThreadLocale GetTickCount HeapReAlloc GetModuleFileNameW HeapSize GetSystemDirectoryW GetThreadLocale OutputDebugStringA LeaveCriticalSection GetSystemTimeAsFileTime InitializeCriticalSection InitializeCriticalSectionEx MapViewOfFile CreateFileMappingW FileTimeToLocalFileTime DeleteFileW GetLastError CloseHandle DisableThreadLibraryCalls FindClose RaiseException FindNextFileW UnmapViewOfFile GetProcAddress DeleteCriticalSection GetModuleHandleW FileTimeToSystemTime GetFileSizeEx lstrcmpiW LoadLibraryExW FreeLibrary SizeofResource InitOnceExecuteOnce LoadResource FindResourceExW WriteFile LockResource CreateFileW MultiByteToWideChar EnterCriticalSection FindFirstFileW

ole32

StringFromGUID2 CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoCreateInstance CoTaskMemRealloc

oleaut32

VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysFreeString RegisterTypeLi SysAllocStringByteLen SysAllocStringLen SysStringByteLen VariantInit VariantClear VariantChangeType SafeArrayAccessData LoadRegTypeLi SafeArrayCreate SafeArrayUnaccessData VariantCopy SafeArrayGetVartype SafeArrayCopy SafeArrayDestroy SysAllocString SysStringLen

advapi32

RegEnumKeyExW RegCreateKeyExW RegDeleteValueW RegCloseKey RegQueryInfoKeyW TraceMessage GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids RegOpenKeyExW RegSetValueExW

user32

CharNextW UnregisterClassA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ntdll

RtlInitUnicodeString NtQueryValueKey RtlFreeHeap RtlAllocateHeap

vrfcore

VerifierSetLayerProperty VerifierQueryLayerProperty VerifierIsLayerEnabled VerifierQueryLayerBreak VerifierEnableLayer VerifierCloseLayerProperties VerifierDisableVerifier VerifierOpenLayerProperties VerifierGetLoggingDirectory VerifierCreateLayerProperties VerifierQueryRegisteredLayers VerifierSetLayerBreak VerifierDisableLayer

dbghelp

SymGetLineFromAddr64 SymUnloadModule64 SymGetModuleInfo64 SymSetOptions SymLoadModule64 SymRegisterCallback64 SymCleanup SymGetSymFromAddr64 SymInitialize

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

bot.dll

msvcrt

kernel32

ole32

oleaut32

advapi32

user32

version

ntdll

vrfcore

dbghelp

generic