version[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.dll
Size 1.1MB
Sample260709-rt43facy2s
SHA256 872caafdb23c8e84124877c6877135e1b2b5085df92a47ea0f059b44fd27b9fd
MD5 9ba816d4cab79076d46a8c14a24edc3e
SHA1 06bf57511de95cf231b7f8e69826593be5c6253f
SHA512 8a7f26ca49ce48a3fc7f8514f1b1d7ca56d53774931ad033910c33264d2987e18ff6ed25e1f8deb8d1888fa7c729cb1dfd76e8e75553c6626098e673df101db1
SSDEEP 24576:zPt8bpqWX6OiKg+eCZ8J32Cy2oRPOSBmUNfsDOON4/Ggn6a+RH:zspb6zty81/noRPOSBmUNfsDN4/Bn61
TLSH
T12D359E59B2B441F8D07BE078CA83A90BE6313848073499FB67F04D565F637E15ABBB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 1.1MB

version.dll

IMPHASH 9da0ec414d7337275dca9600ce4183de
SHA256 872caafdb23c8e84124877c6877135e1b2b5085df92a47ea0f059b44fd27b9fd
MD5 9ba816d4cab79076d46a8c14a24edc3e
SHA1 06bf57511de95cf231b7f8e69826593be5c6253f
SHA512 8a7f26ca49ce48a3fc7f8514f1b1d7ca56d53774931ad033910c33264d2987e18ff6ed25e1f8deb8d1888fa7c729cb1dfd76e8e75553c6626098e673df101db1
SSDEEP 24576:zPt8bpqWX6OiKg+eCZ8J32Cy2oRPOSBmUNfsDOON4/Ggn6a+RH:zspb6zty81/noRPOSBmUNfsDN4/Bn61
TLSH
T12D359E59B2B441F8D07BE078CA83A90BE6313848073499FB67F04D565F637E15ABBB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

905264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\trace\OneDrive\Desktop\illusions bypass backup\illusions bypass\delusion\spotify\version\bin\x64\Release\version.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SetThreadAffinityMask SetThreadPriority Sleep GetCurrentThread SwitchToThread GetCurrentProcess GetStdHandle SetConsoleMode TerminateProcess CreateMutexA GetCurrentThreadId CreateToolhelp32Snapshot GetConsoleMode GetLastError Process32NextW DisableThreadLibraryCalls Process32FirstW CloseHandle CreateThread GetCurrentProcessId GetTickCount IsDebuggerPresent GetSystemDirectoryW lstrcatW LoadLibraryW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetProcessId DuplicateHandle OpenProcess Module32FirstW Module32NextW QueryPerformanceCounter GetModuleHandleW SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree AcquireSRWLockShared ReleaseSRWLockShared InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive MoveFileExW GetFileInformationByHandleEx VirtualQueryEx ReadProcessMemory VirtualProtectEx GetTickCount64 FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA WriteProcessMemory GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CreateFile2 AreFileApisANSI

user32

GetCursorPos ReleaseDC SetCursorPos ReleaseCapture OpenClipboard CloseClipboard EmptyClipboard IsWindowUnicode GetClipboardData ShowCursor mouse_event GetWindowTextA SendInput DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics GetWindowThreadProcessId GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow GetDC GetMessageExtraInfo GetKeyState UpdateWindow FindWindowA PostQuitMessage SetWindowLongW TranslateMessage BringWindowToTop SetLayeredWindowAttributes MoveWindow SetWindowDisplayAffinity PeekMessageW GetMonitorInfoW DispatchMessageW GetAsyncKeyState ShowWindow RegisterClassExW UnregisterClassW SetClipboardData

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegQueryValueExW

shell32

ShellExecuteA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Xtime_get_ticks ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?_Random_device@std@@YAIXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Thrd_id _Thrd_join _Cnd_broadcast ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpSetTimeouts WinHttpOpen WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpCloseHandle

winmm

timeBeginPeriod timeGetTime

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context _CxxThrowException __std_type_info_destroy_list __current_exception memcmp memcpy memmove memset memchr __std_terminate strstr __C_specific_handler strchr __std_exception_destroy __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

ftell fwrite _get_stream_buffer_pointers _fseeki64 __acrt_iob_func setvbuf fgetpos fputc ungetc fgetc _wfopen __stdio_common_vsprintf_s __stdio_common_vsprintf fflush fread fclose __stdio_common_vsscanf __stdio_common_vfprintf fseek fsetpos

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc realloc

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoll atof strtoull

api-ms-win-crt-runtime-l1-1-0

_cexit _initterm _initterm_e abort _execute_onexit_table _register_onexit_function _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll terminate _beginthreadex _crt_atexit system _initialize_onexit_table exit _errno

api-ms-win-crt-time-l1-1-0

_gmtime64_s _localtime64_s strftime _time64

api-ms-win-crt-math-l1-1-0

sqrt powf _dsign sin logf sqrtf cosf cos acosf ldexp sinf atan2f ceilf fmodf

api-ms-win-crt-string-l1-1-0

strlen strcmp strcpy_s isspace isdigit _wcsicmp _stricmp strncmp tolower strncpy wcslen

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s