ProShifter[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ProShifter.dll
Size 5.3MB
Sample260706-lezxaag14p
SHA256 54b47ddd9a772d9ea12d16f6c76aa485757197bfb84fe74cfb434f638e460a2f
MD5 cc83ea23a39e9287e245832522d188f3
SHA1 1d66779ade2dd41aba3cbaa3f3bc0991bdfa67d2
SHA512 39e281f90d152421fa93e27ef70a177af8ee13167be5bf77e5fccffd1632724e37a63ea123ff1812c9e257eede8e8a29b9df885a65900d11a6fe311a6e464458
SSDEEP 49152:2Un/o6BMZJ4ZC/8kjqNuM/KG+kesK9ZoZsCDiTNbKolWRTnIoFkpVG6aRToBU2BN:xsCFCBU2BBUNpu
TLSH
T13E468D87B2BA10D8D076C07DC787951BEB7278050325DBDB15A1866ABF27FE14E7E220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProShifter.dll

File Explorer

ProShifter.dll

.dll 5.3MB

ProShifter.dll

IMPHASH faa4f50a62862cdd0fb72f10f3d81373
SHA256 54b47ddd9a772d9ea12d16f6c76aa485757197bfb84fe74cfb434f638e460a2f
MD5 cc83ea23a39e9287e245832522d188f3
SHA1 1d66779ade2dd41aba3cbaa3f3bc0991bdfa67d2
SHA512 39e281f90d152421fa93e27ef70a177af8ee13167be5bf77e5fccffd1632724e37a63ea123ff1812c9e257eede8e8a29b9df885a65900d11a6fe311a6e464458
SSDEEP 49152:2Un/o6BMZJ4ZC/8kjqNuM/KG+kesK9ZoZsCDiTNbKolWRTnIoFkpVG6aRToBU2BN:xsCFCBU2BBUNpu
TLSH
T13E468D87B2BA10D8D076C07DC787951BEB7278050325DBDB15A1866ABF27FE14E7E220
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1511696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\vassi\Documents\cx\NewProject\Builds\VisualStudio2026\x64\Release\VST\ProShifter.pdb

kernel32

DisconnectNamedPipe GetLogicalDriveStringsW CreateEventW Sleep GetFileInformationByHandle FormatMessageW GetLastError GetFileAttributesExW OutputDebugStringW SetEvent GetLogicalProcessorInformation TerminateThread QueryPerformanceFrequency DeleteFileW GetNativeSystemInfo LoadLibraryW GetCurrentDirectoryW GetOverlappedResult GetProcAddress LocalFree ReplaceFileW DeleteCriticalSection ExitProcess GetModuleHandleW FreeLibrary CopyFileW QueryPerformanceCounter MoveFileW GetDriveTypeW ConnectNamedPipe FlushFileBuffers GetCommandLineW AttachConsole CompareStringOrdinal GlobalSize LoadLibraryA GlobalAlloc GlobalFree GlobalLock GetCurrentProcessId GlobalUnlock GetThreadPriority InitializeSListHead GetSystemTimeAsFileTime WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetTickCount64 SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleA UnmapViewOfFile ResumeThread GetSystemDirectoryW ReleaseMutex GetCurrentThreadId GetFileAttributesW CreateFileW FindClose CreateMutexW GetTempPathW Process32First GetCurrentProcess WaitForSingleObject CreateToolhelp32Snapshot GetTempPathA DeleteFileA Process32Next CloseHandle CreateProcessA CreateDirectoryW SetThreadAffinityMask GetSystemFirmwareTable ReadFile TryEnterCriticalSection GetVolumeInformationW CancelIo FindFirstFileW SetPriorityClass GetCurrentThread EnterCriticalSection FindNextFileW WriteFile GetModuleHandleExW RemoveDirectoryW GetFinalPathNameByHandleW GetModuleFileNameW WaitForMultipleObjects SetThreadPriority LeaveCriticalSection InitializeCriticalSection SetFilePointer SetEndOfFile

user32

GetAncestor GetClassNameA GetSystemMetrics TranslateMessage GetWindowTextW GetUpdateRgn MonitorFromWindow ValidateRgn ValidateRect SystemParametersInfoW GetWindowThreadProcessId SetFocus CallWindowProcW MoveWindow GetWindowLongW GetSystemMenu GetMessageExtraInfo GetMessagePos MapVirtualKeyW GetDC IsWindowVisible GetDpiForWindow MonitorFromRect EnumChildWindows EnumDisplayMonitors GetIconInfo SendMessageW CallNextHookEx EndDialog SetWindowTextW MessageBeep WindowFromPoint GetWindowPlacement DestroyCursor GetKeyboardState SetCaretPos GetActiveWindow AttachThreadInput IsWindow GetAsyncKeyState OpenClipboard GetCapture RedrawWindow DestroyIcon VkKeyScanW GetWindowInfo GetMonitorInfoW CreateIconIndirect CloseClipboard EmptyClipboard IsChild CreateCaret MapWindowPoints TrackMouseEvent GetForegroundWindow UnhookWindowsHookEx GetMessageTime SetLayeredWindowAttributes BringWindowToTop GetClipboardData LoadIconW EnumDisplayDevicesW LoadCursorW DestroyCaret SetCapture SetWindowsHookExW SetClipboardData ToUnicode SetCursor SetWindowLongW GetSystemMetricsForDpi GetClientRect UpdateLayeredWindow DrawIconEx ShowCaret GetDesktopWindow EnumDisplaySettingsW EnableMenuItem GetParent ReleaseCapture InvalidateRect SetCursorPos ReleaseDC GetCursorPos BeginPaint EndPaint SendInput GetMessageW DefWindowProcW PostMessageW GetWindowRect EnumWindows PeekMessageW DispatchMessageW RegisterClassExW GetWindowLongPtrW UnregisterClassW CreateWindowExW SetWindowLongPtrW DestroyWindow GetFocus SendMessageTimeoutW SendNotifyMessageW ShowWindow SetWindowPos

gdi32

StretchBlt StretchDIBits CreateRectRgnIndirect GetDeviceCaps SetBrushOrgEx ExcludeClipRect SetStretchBltMode RestoreDC CreateBitmap SaveDC SelectObject CreateCompatibleDC CreateRectRgn DeleteDC SetMapperFlags GetRegionData DeleteObject SetMapMode CreateFontIndirectW CreateDIBSection CombineRgn BitBlt GetObjectW

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

AccessCheck GetNamedSecurityInfoW DuplicateToken OpenProcessToken MapGenericMask GetTokenInformation

shell32

SHGetPathFromIDListW ShellExecuteW SHGetSpecialFolderPathW DragQueryFileW SHCreateShellItem SHGetMalloc ExtractAssociatedIconW SHBrowseForFolderW SHGetKnownFolderPath SHParseDisplayName Shell_NotifyIconW

ole32

CoCreateInstance OleUninitialize OleCreate CoTaskMemFree CoTaskMemAlloc CoUninitialize OleInitialize DoDragDrop RegisterDragDrop CoInitializeEx RevokeDragDrop OleSetContainedObject

oleaut32

SafeArrayDestroy SysAllocString SafeArrayPutElement SafeArrayUnaccessData SafeArrayCreateVector SafeArrayAccessData

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Cnd_broadcast _Mtx_unlock _Query_perf_counter _Thrd_id _Cnd_wait _Mtx_lock ?classic@locale@std@@SAAEBV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Thrd_yield ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_signal ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ?__ExceptionPtrCurrentException@@YAXPEAX@Z _Cnd_do_broadcast_at_thread_exit _Thrd_join ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

urlmon

URLDownloadToFileA

wininet

InternetWriteFile HttpOpenRequestW InternetSetOptionW HttpQueryInfoW HttpSendRequestExW FtpOpenFileW InternetOpenW InternetConnectW InternetCloseHandle InternetReadFile HttpEndRequestW InternetCrackUrlW InternetSetFilePointer

ws2_32

accept bind select getaddrinfo WSAStartup inet_addr __WSAFDIsSet inet_ntoa recv getsockopt htonl htons freeaddrinfo sendto ioctlsocket setsockopt send closesocket

shlwapi

PathStripToRootW

winmm

timeKillEvent timeBeginPeriod timeGetTime

d2d1

ord1

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

imm32

ImmGetContext ImmAssociateContext ImmGetCompositionStringW ImmSetCandidateWindow ImmAssociateContextEx ImmNotifyIME ImmReleaseContext

comctl32

ord410 ord413 ord345 ord412

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __std_type_info_destroy_list _CxxThrowException __current_exception_context longjmp __std_type_info_compare __std_terminate _purecall __std_exception_copy __std_exception_destroy __current_exception strstr strchr __RTtypeid memcmp __RTDynamicCast __C_specific_handler memset memmove memcpy

api-ms-win-crt-heap-l1-1-0

calloc realloc _callnewh free malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf ungetc _get_stream_buffer_pointers __stdio_common_vfprintf freopen_s ferror _fseeki64 setvbuf __stdio_common_vsprintf fgetpos fwrite fgetc __stdio_common_vsprintf_s fclose fflush __acrt_iob_func _fileno fread fsetpos fputc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

towlower _stricmp iswspace towupper iswdigit strcat_s iswalnum strcmp strlen strncmp strncpy iswalpha wcslen strnlen

api-ms-win-crt-time-l1-1-0

_ftime64_s wcsftime _localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit _seh_filter_dll abort _beginthreadex _endthreadex terminate _fpreset _initterm_e

api-ms-win-crt-convert-l1-1-0

_atoi64 _strtod_l atoi mbstowcs

api-ms-win-crt-locale-l1-1-0

_create_locale

api-ms-win-crt-math-l1-1-0

tan sqrtf sqrt floorf floor truncf acos tanf logf sin powf log sinf fmodf atan2 atan2f _hypot ceil ceilf cos _fdclass _hypotf _dclass pow cosf exp expf fmod

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1001KB

Virtual Size

1001KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ProShifter.dll

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcp140

urlmon

wininet

ws2_32

shlwapi

winmm

d2d1

dxgi

d3d11

dcomp

imm32

comctl32

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic