622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e.dll
Size 14.5MB
Sample260709-merfkshv7y
SHA256 622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e
MD5 21ea7b46d8a082339a58212343f73912
SHA1 e558e5a2eb634f09ba0a79b29903ca80d8c6fdb5
SHA512 37a9e0632da925a62bc3a07987689b346560bf70aaefe5367268758b79ddd0075821b4dae048e65720dabc564a6b86a20df23d90d889a0c68b1417a282d25675
SSDEEP 393216:vczFsEQW8MFfGiirnGhJYxM/2/JDnTMU8IGo38:vEeiiSUVxPh8IGX
TLSH
T116E6F1202605C337D5AE42F1AB3D5E9F602EAEB1037454CB93C86E7918F5DD26B36A13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e.dll

File Explorer

622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e.dll

.dll 14.5MB

622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e.dll

IMPHASH c1142b1257fc2db605816ebc9e3f4c1d
SHA256 622e7a8f6a0f40a1f344aa516b055fd6a55f08bf96d58a92573c5f08b992158e
MD5 21ea7b46d8a082339a58212343f73912
SHA1 e558e5a2eb634f09ba0a79b29903ca80d8c6fdb5
SHA512 37a9e0632da925a62bc3a07987689b346560bf70aaefe5367268758b79ddd0075821b4dae048e65720dabc564a6b86a20df23d90d889a0c68b1417a282d25675
SSDEEP 393216:vczFsEQW8MFfGiirnGhJYxM/2/JDnTMU8IGo38:vEeiiSUVxPh8IGX
TLSH
T116E6F1202605C337D5AE42F1AB3D5E9F602EAEB1037454CB93C86E7918F5DD26B36A13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2744773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\Zipper\Zipper_tpi\bin\Release\ool.pdb

kernel32

CompareFileTime GetShortPathNameW MulDiv FreeResource WaitForSingleObject SetEvent SetLastError DosDateTimeToFileTime GlobalMemoryStatusEx GetSystemTimes GetConsoleDisplayMode AttachConsole FreeConsole GetCurrentProcessId UnmapViewOfFile MapViewOfFile CreateFileMappingW SetFilePointer CreateFileA WideCharToMultiByte MoveFileExW RaiseException LocalFileTimeToFileTime lstrcpyW lstrcpynW LoadLibraryW GetModuleFileNameW FreeLibrary GetCurrentProcess CloseHandle DeleteFileW LeaveCriticalSection EnterCriticalSection MoveFileW lstrlenW lstrcmpW LocalFree GlobalSize GetSystemWow64DirectoryW GetWindowsDirectoryW GetSystemDirectoryW GetStartupInfoW CreateProcessW GetTempPathW SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesW GetDriveTypeW FindNextFileW FindFirstFileW FindClose GetSystemInfo FileTimeToSystemTime Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetModuleFileNameExW GetLocalTime GetFileAttributesExW CreateDirectoryW GlobalLock GlobalUnlock CreateMutexW ReleaseMutex QueryDosDeviceW GetLogicalDriveStringsW GetFileType WaitForMultipleObjects ReadDirectoryChangesW CancelIo PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort CreateFileW VirtualFreeEx WriteProcessMemory ReadProcessMemory VirtualAllocEx OpenProcess WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetProcAddress GetModuleHandleW GetVersionExW DeleteCriticalSection InitializeCriticalSectionEx InitializeCriticalSection GetLastError DecodePointer FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy Sleep SystemTimeToFileTime GetCurrentThreadId WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetEndOfFile SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList RtlUnwind CreateFileMappingA FindNextFileA FindFirstFileA GetModuleHandleA GetStdHandle lstrcmpA LoadLibraryExW GetSystemWindowsDirectoryW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter lstrcmpiW GlobalAlloc InitializeCriticalSectionAndSpinCount FormatMessageW ExitProcess GetACP GetTickCount VerifyVersionInfoW VerSetConditionMask GetFileSize FlushFileBuffers WriteFile ReadFile LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList CreateEventW WaitForSingleObjectEx InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent InitOnceBeginInitialize InitOnceComplete FormatMessageA GetStringTypeW GetLocaleInfoEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentDirectoryW FindFirstFileExW SetFileTime AreFileApisANSI DeviceIoControl GetFileInformationByHandleEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime MultiByteToWideChar

user32

RegisterWindowMessageW GetWindow GetWindowThreadProcessId FindWindowExW GetClassNameW PostThreadMessageW FindWindowW SendMessageW LoadCursorW SetWindowLongW GetWindowLongW KillTimer SetTimer DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW MessageBoxW IsZoomed CharNextW SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect MapWindowPoints GetSysColor PostMessageW OffsetRect IsRectEmpty GetParent LoadImageW MonitorFromWindow SetCursor InflateRect RegisterClassW ShowWindow EnableWindow SetPropW GetPropW SetWindowRgn UpdateWindow UpdateLayeredWindow MoveWindow IsWindowEnabled GetWindowRgn CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen SetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW SetClipboardData keybd_event GetProcessWindowStation GetUserObjectInformationW MessageBoxA DefWindowProcW UnregisterClassW GetWindowRect UnionRect ChangeWindowMessageFilter PeekMessageW DestroyIcon EnumChildWindows GetDlgItem IsIconic SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumClipboardFormats GetAsyncKeyState GetClipboardSequenceNumber IsWindowVisible GetAncestor GetWindowInfo MonitorFromRect MonitorFromPoint GetShellWindow GetDesktopWindow EqualRect IntersectRect WindowFromPoint DispatchMessageW TranslateMessage GetMessageW ScreenToClient SetWindowPos PostQuitMessage UnhookWinEvent SetWinEventHook EnumDisplayMonitors GetMonitorInfoW EnumWindows PtInRect CopyRect GetCursorPos GetWindowTextW ReleaseDC GetDC SetForegroundWindow GetForegroundWindow IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard BringWindowToTop AttachThreadInput wsprintfW

gdi32

GetStockObject DeleteDC CreateCompatibleDC CreateFontIndirectW CreatePen DeleteObject AddFontMemResourceEx RemoveFontMemResourceEx Rectangle RestoreDC SaveDC CloseEnhMetaFile CreateEnhMetaFileW GetEnhMetaFileHeader PlayEnhMetaFile GetTextMetricsW GetObjectW SetWindowOrgEx SelectObject CreateRectRgn PtInRegion CreateDIBSection CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush CreateDIBitmap GetClipBox LineTo SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor MoveToEx TextOutW GdiFlush CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits CreateCompatibleBitmap BitBlt GetDeviceCaps GetTextExtentPoint32W CreateRoundRectRgn GetCharABCWidthsW

advapi32

RegCopyTreeW RegQueryInfoKeyW ConvertSidToStringSidW RegGetValueW RegDeleteTreeW RegSetValueExW RegCreateKeyExW GetTokenInformation IsValidSid RegOpenKeyW RegEnumValueW RegEnumKeyW RegQueryValueExW RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegEnumKeyExW RegCloseKey DeregisterEventSource RegisterEventSourceA ReportEventA

shell32

SHGetDiskFreeSpaceExW ShellExecuteW SHQueryUserNotificationState SHQueryRecycleBinW SHFileOperationW SHGetDesktopFolder SHGetKnownFolderPath SHGetFolderLocation SHGetPathFromIDListW ord155 SHCreateItemFromParsingName ord727 SHGetFileInfoW DragQueryFileW SHGetSpecialFolderPathW ShellExecuteExW ord68 SHGetFolderPathW ord165

ole32

OleLockRunning CoUninitialize CoCreateGuid CoTaskMemFree StringFromCLSID ReleaseStgMedium CLSIDFromProgID OleInitialize CLSIDFromString DoDragDrop CoCreateInstance CoInitialize CoInitializeSecurity CreateStreamOnHGlobal OleUninitialize OleDuplicateData CoSetProxyBlanket CoInitializeEx

oleaut32

VariantClear VariantInit SysAllocStringLen SysFreeString SystemTimeToVariantTime SysStringLen SysAllocString VariantTimeToSystemTime

shlwapi

PathAddBackslashW StrCmpIW PathAppendW PathRemoveFileSpecW wnsprintfW PathCombineW PathIsDirectoryW PathFileExistsW StrStrIW StrFormatByteSizeW PathFindExtensionW StrStrW SHDeleteKeyW StrCmpW StrRetToStrW ord176 StrCmpNIW StrTrimA StrStrIA PathFindFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipFillPath GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromGdiDib GdipDrawImageI GdipDrawLine GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipSetPenEndCap GdipSetPenStartCap GdipCreatePen2 GdipRotateWorldTransform GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdiplusStartup GdiplusShutdown GdipCreatePath GdipDeletePath GdipAddPathLine GdipAddPathArc GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipReleaseDC GdipSetSmoothingMode GdipTranslateWorldTransform GdipSetWorldTransform GdipResetWorldTransform GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipDrawImageRectRect GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawImageRectI

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

msi

ord173 ord217

dwmapi

DwmGetWindowAttribute

ws2_32

gethostname WSAStartup gethostbyname

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

generic

count=39, id=259, version=30795,

count=211, id=261, version=30795,

count=11, id=260, version=35213,

count=3, productName=Unmarked objects (old),

count=21, id=260, version=35211,

count=2, id=253, version=35207,

count=21, id=260, version=35207,

count=1, id=263, version=30795,

count=1, id=261, version=35211,

count=5, id=265, version=35213,

count=27, id=259, version=35207,

count=100, id=261, version=35207,

count=49, id=260, version=30795,

count=1, id=262, version=30795,

count=41, id=257, version=30795,

count=646, id=1, productName=Unmarked objects,

count=209, id=261, version=35213,

count=1, id=256, version=35213,

count=1, id=255, version=35213,

count=1, id=151,

count=1, id=258, version=35213,