mozglue[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mozglue.dll
Size 558KB
Sample260710-j9f2jsfz4k
SHA256 ec335926c09647775506d9d7931bf869272b94bd77b9123ac668ca0050432804
MD5 67e48f5cd0b75642ba1ebfb0b135f0af
SHA1 f26ede8f235c09afb65bd257181ed5729f6486d7
SHA512 7f3e66e5ec14ddfce2606d1218d99d7e54795b7ea5b59cf2c89191e5fb84b02064920c045bba20a3547af12a935f9f5cabe3ed34db5f285036236d7c49135579
SSDEEP 12288:Jg06PIUkebh120e3U2QUf9t7DlO0VvlhlV5EiW6iI7V:J0PIUB120etnpTlhr5EiW6
TLSH
T1EAC46C07F2A291B8D05AD0798357A67BFB73B88A8131BA7F27D467313E54B50AB0D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mozglue.dll

File Explorer

mozglue.dll

.dll 558KB

mozglue.dll

IMPHASH f790b346b9a38b569f2fda6627f7d804
SHA256 ec335926c09647775506d9d7931bf869272b94bd77b9123ac668ca0050432804
MD5 67e48f5cd0b75642ba1ebfb0b135f0af
SHA1 f26ede8f235c09afb65bd257181ed5729f6486d7
SHA512 7f3e66e5ec14ddfce2606d1218d99d7e54795b7ea5b59cf2c89191e5fb84b02064920c045bba20a3547af12a935f9f5cabe3ed34db5f285036236d7c49135579
SSDEEP 12288:Jg06PIUkebh120e3U2QUf9t7DlO0VvlhlV5EiW6iI7V:J0PIUB120etnpTlhr5EiW6
TLSH
T1EAC46C07F2A291B8D05AD0798357A67BFB73B88A8131BA7F27D467313E54B50AB0D704
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

comctl32

InitCommonControlsEx

gdi32

GetDeviceCaps GetStockObject

kernel32

AddVectoredExceptionHandler CloseHandle CreateDirectoryW CreateFileA CreateFileMappingA CreateFileW CreateMutexW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo GetSystemTimePreciseAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList K32EnumProcessModules K32GetModuleBaseNameW K32GetModuleInformation LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile RemoveDirectoryW RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetWaitableTimer Sleep SleepEx TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__iob_func _amsg_exit _initterm _lock _setjmp _unlock abort calloc fwrite longjmp memcmp memcpy memmove memset strlen strncmp vfprintf

ole32

CoCreateGuid CoInitializeEx CoUninitialize

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

user32

GetDesktopWindow GetSystemMetrics IsWindowVisible

version

GetFileVersionInfoSizeW

Name

.text

Size

437KB

Virtual Size

437KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

741B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mozglue.dll

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

bcrypt

comctl32

gdi32

kernel32

msvcrt

ole32

shell32

shlwapi

user32

version

generic