mozglue[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mozglue.dll
Size 558KB
Sample260708-xde19sgs21
SHA256 8a4772d3f51dcd8e7620153a0587ffb68e9e6e0391c6d2f87d1d4ce36c296d1d
MD5 a61deb77cabd65965fd22c422166cf0c
SHA1 a699e329305bf0d8d5b9fd16ae8a1a18173071e6
SHA512 7bcdb85d6d6494e78fcb6ed9a7fa83d5a22c0060f1cbc1d5035b00368e115e0ed3fb4827715bb4b99bf69c5ac2c471b1e7168b7fbf97794e55dc27cc087ff047
SSDEEP 12288:1BY7Z3Cf1KPrE4HX2/tdl3rhYnCYGBVFizv0oV:vCCf1KP/GdWnCY4VFizv0
TLSH
T164C45C07F2A290B8D05AD0788357A67BFB32B88AC531B9BF27D46B313E55B506B0D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mozglue.dll

File Explorer

mozglue.dll

.dll 558KB

mozglue.dll

IMPHASH 6c71f544f905aa66548b5a5dbb4f9ee1
SHA256 8a4772d3f51dcd8e7620153a0587ffb68e9e6e0391c6d2f87d1d4ce36c296d1d
MD5 a61deb77cabd65965fd22c422166cf0c
SHA1 a699e329305bf0d8d5b9fd16ae8a1a18173071e6
SHA512 7bcdb85d6d6494e78fcb6ed9a7fa83d5a22c0060f1cbc1d5035b00368e115e0ed3fb4827715bb4b99bf69c5ac2c471b1e7168b7fbf97794e55dc27cc087ff047
SSDEEP 12288:1BY7Z3Cf1KPrE4HX2/tdl3rhYnCYGBVFizv0oV:vCCf1KP/GdWnCY4VFizv0
TLSH
T164C45C07F2A290B8D05AD0788357A67BFB32B88AC531B9BF27D46B313E55B506B0D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

comctl32

InitCommonControlsEx

gdi32

GetDeviceCaps GetStockObject

kernel32

AddVectoredExceptionHandler CloseHandle CreateDirectoryW CreateFileA CreateFileMappingA CreateFileW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo GetSystemTimePreciseAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList K32EnumProcessModules K32GetModuleBaseNameW K32GetModuleInformation LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile RemoveDirectoryW RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetWaitableTimer Sleep SleepEx TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__iob_func _amsg_exit _initterm _lock _setjmp _unlock abort calloc fwrite longjmp memcmp memcpy memmove memset strlen strncmp vfprintf

ole32

CoCreateGuid CoInitializeEx CoUninitialize

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

user32

GetDesktopWindow GetSystemMetrics IsWindowVisible

version

GetFileVersionInfoSizeW

Name

.text

Size

438KB

Virtual Size

437KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

741B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mozglue.dll

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

bcrypt

comctl32

gdi32

kernel32

msvcrt

ole32

shell32

shlwapi

user32

version

generic