xzblib0[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xzblib0.dll
Size 13.1MB
Sample260710-tmlzdsez51
SHA256 af0b790887e059157eb720aa16f2e7af626c24aa670e2a549ab07c0b9f7fe23a
MD5 e6ae3d0dd89ef1fbd9f1c8c65d871bc2
SHA1 184240b786d26b62de6b2f976c6ca02c03ef30df
SHA512 2ac6fcb70fd523f1af63a9955b4297a4d3f0028976d96570cb60ae580355488b1c7a2ebd6fa060055d68c7ef98a94a9a00a4f56750d1a314e6c9f1081d41bd1d
SSDEEP 393216:FT1eh+5+/EGJOMnsaODTE94mQf4cP3OXKWkA7N:B1eQ5nGJnniDQ2+03zbA7N
TLSH
T1EED623ED94A122E4E4D38A80738A57CD61D0659C52FC4D2D3CDA2C026F25D2FAA4DDFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xzblib0.dll

File Explorer

xzblib0.dll

.dll 13.1MB

xzblib0.dll

IMPHASH 23359b5a2488fdb9d279b1ead9561c4e
SHA256 af0b790887e059157eb720aa16f2e7af626c24aa670e2a549ab07c0b9f7fe23a
MD5 e6ae3d0dd89ef1fbd9f1c8c65d871bc2
SHA1 184240b786d26b62de6b2f976c6ca02c03ef30df
SHA512 2ac6fcb70fd523f1af63a9955b4297a4d3f0028976d96570cb60ae580355488b1c7a2ebd6fa060055d68c7ef98a94a9a00a4f56750d1a314e6c9f1081d41bd1d
SSDEEP 393216:FT1eh+5+/EGJOMnsaODTE94mQf4cP3OXKWkA7N:B1eQ5nGJnniDQ2+03zbA7N
TLSH
T1EED623ED94A122E4E4D38A80738A57CD61D0659C52FC4D2D3CDA2C026F25D2FAA4DDFB
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9061761

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

70B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspr0

Size

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.aspr1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspr2

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

xzblib0.dll

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic