libpsl-5[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
libpsl-5.dll.exe
Size 11.7MB
Sample260714-eypgbsd19p
SHA256 7b98bdc168a9c682be8d432bdd383da72b241909fb955332dbdb09f45c8e4a51
MD5 d5787eb5ce307c560f336717d17fd905
SHA1 4fa8505d59d657995d1a6751a37cb9cb5d9e5e73
SHA512 bf77ee7dbf5fba6cad33c833d267afaac0117de328ddc39ef91dc7aa5a65e63b0d6f4063ab8fe885468004f869857eeaf754c7c089a4e9006e2aff591905bc8f
SSDEEP 196608:3GR92+U+j4hvgCiJNaG8mkWMHsLGIclz:WR9ZFMlgj3aGp/MHsqIAz
TLSH
T16CC6BF19A3E50465E42BC734CA56C333DAB4BDA24635C10F095DF2C22F77A628B6F726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libpsl-5.dll.exe

File Explorer

libpsl-5.dll.exe

.dll 11.7MB

libpsl-5.dll.exe

IMPHASH c46bdb18e323b17caf949ae831e40ccd
SHA256 7b98bdc168a9c682be8d432bdd383da72b241909fb955332dbdb09f45c8e4a51
MD5 d5787eb5ce307c560f336717d17fd905
SHA1 4fa8505d59d657995d1a6751a37cb9cb5d9e5e73
SHA512 bf77ee7dbf5fba6cad33c833d267afaac0117de328ddc39ef91dc7aa5a65e63b0d6f4063ab8fe885468004f869857eeaf754c7c089a4e9006e2aff591905bc8f
SSDEEP 196608:3GR92+U+j4hvgCiJNaG8mkWMHsLGIclz:WR9ZFMlgj3aGp/MHsqIAz
TLSH
T16CC6BF19A3E50465E42BC734CA56C333DAB4BDA24635C10F095DF2C22F77A628B6F726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

752256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW GetTokenInformation OpenThreadToken RevertToSelf ImpersonateLoggedOnUser

bcrypt

BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptDestroyHash BCryptHashData BCryptGetProperty BCryptFinishHash BCryptExportKey BCryptDecrypt BCryptEncrypt BCryptCreateHash BCryptGenRandom BCryptImportKey BCryptSetProperty BCryptOpenAlgorithmProvider

crypt32

CertFreeCertificateChainEngine CertCloseStore PFXImportCertStore PFXExportCertStore CryptFindOIDInfo CryptQueryObject CryptMsgGetParam CryptMsgClose CryptImportPublicKeyInfoEx2 CryptFormatObject CryptDecodeObject CertVerifyTimeValidity CertSetCertificateContextProperty CertSerializeCertificateStoreElement CertSaveStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertAddCertificateContextToStore CertAddCertificateLinkToStore CertControlStore CertCreateCertificateChainEngine CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertGetIntendedKeyUsage CertGetNameStringW CertGetValidUsages CertNameToStrW

iphlpapi

GetAdaptersAddresses GetPerAdapterInfo GetNetworkParams if_nametoindex

kernel32

InitializeSListHead RtlUnwindEx GetProcessHeap InterlockedFlushSList RtlPcToFileHeader RaiseException FlsFree HeapFree HeapAlloc HeapDestroy HeapCreate DecodePointer GetTickCount64 SetLastError FormatMessageW GetLastError GetCPInfoExW GetConsoleMode GetFileType ReadFile ReadConsoleW WriteFile WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte CloseHandle GetExitCodeProcess OpenProcess K32EnumProcesses GetProcessId DuplicateHandle GetCurrentProcess ReadDirectoryChangesW CreateFileW QueryPerformanceCounter LoadLibraryExW CancelIoEx CloseThreadpoolIo GetCurrentProcessId GetEnvironmentStringsW RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable InitializeCriticalSection InitializeConditionVariable CreateThreadpoolTimer SetThreadpoolTimer WaitForMultipleObjectsEx GetCurrentThreadId CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW GetCPInfo LocalAlloc GetProcAddress CancelSynchronousIo CreateIoCompletionPort CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW OpenThread OutputDebugStringW QueryUnbiasedInterruptTime SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode CreateThread ResumeThread GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FreeEnvironmentStringsW CreateDirectoryW FindFirstFileW FindNextFileW GetFileSize FreeConsole GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo EncodePointer

ncrypt

NCryptFreeObject NCryptSetProperty NCryptGetProperty NCryptOpenStorageProvider NCryptDeleteKey NCryptImportKey NCryptOpenKey

ole32

CoInitializeEx CoUninitialize CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoWaitForMultipleHandles CoTaskMemFree

secur32

GetUserNameExW

user32

LoadStringW

ws2_32

WSAConnect WSARecv setsockopt send select recv listen WSAGetOverlappedResult WSASend accept getsockopt bind getpeername getsockname shutdown closesocket gethostname GetNameInfoW GetAddrInfoW FreeAddrInfoW WSASocketW GetAddrInfoExW WSAStartup WSACleanup FreeAddrInfoExW WSAEventSelect WSAIoctl ioctlsocket

api-ms-win-crt-math-l1-1-0

fmod _fdclass log2 nanf sin fmodf _dclass pow atan2 ceil nan floor log10 cos modf

api-ms-win-crt-heap-l1-1-0

free malloc calloc _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp strcmp strlen strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment terminate _initterm abort _initterm_e _configure_narrow_argv _seh_filter_dll exit

vcruntime140

memcpy memset memmove _purecall

08s5ZEMZE 0dJeQsLVggH1m9V8Q 1IE9BuaTsICLRC 3jFetplE4 3td0b2tZ97o2DzRg 40K6iMcX 4NR9WvNebStbM7PQDnKoprKAz 57EruyEEeJIccb 5vkyENTvOLrTk 6FBwWqudLr2LAPu 6GBUrBsflIm0w 6kOfHKOX0yX6NEy9cBIdz 9xPA3YA3a5xJbcG7iMq6T45mVqi AbzEV4rOWVZ8dE6 BZpNM4MVqEThBlhqQbP5hh D5dmHHd78cAkH5n4 EQAT5D9udO5o FT9k1Lo8GrCIujUsuqOcR9VgknMNSgNI Fi0zBu17WO Fs62t6RvlmPHn67myVPM6Kw GetUtfMode H6QNsN8EmcwzS HHSCL3U0TFfNJ6baETbg JDqtQMbt2Qjj JQSzm67WxxO JZ1bcQWhUAyj4ltjTd4FNrprXp1 LF6ZBkmbEFuRd LGJuyZP4lciGlzU5yikCg3mk4uurKPfQ LWJCGSWn9R LookupStringInFixedSet MTyiApO0oea7Ito MafsJe3StoqNlPXdOn71B1aG01l8 MnAShPAcpsPYRc NTCncXE64B NVKtKqXt4M NhPBp3hGv2umbc NlQIlrvkyBLgMvN OxeGAs0RT1 PZt0jI9sLdsC7 Qhj2ZmCcJfyijgL S5qgZbI U8xycWFuqBHKfBYjmmxg14qSqeMk VeNnHIj VsbCs3s9SBUAXvZDIRQM W2opj7ahjS6zWyxmySyB WOl9lUZ9kzFTl3Z XJCH2GBcSM59bQVczGkcGwBSf4Ij XX8z6W6fjJFVRRaFwM YxjJoDFqcYv09elz8xX1vtpcD cX1pbnzviHw47N89cT6fQhd8J dLplW0O eBdGAFpj fAg3YjpfF4mxtkyPfHP4lbdAF8 fRy0oaSim07FNIy5TrhU fcApdnX1WNZM4TcKVk0zdXCX4rt1J5e g65VYTDhVtXngT0v38 h0KOxEsS h0YF6faPMIcsceQNT4aV1kRYo hCC7qDlF3vkAJ70FGMRjoEh01EIfApGZ i8iuGi2oPNbJjMVyBVyBB317uv3kHa irQ5CWwYxjd irlRWwMQ3sy64LD6tH7A3 jDHCIHc k6WVlkT92l0kVYRStbAeN kYOmZXrhJ7LhJNMvHy klkR0SyVMdNsvRVhgMs l3YMU8im8JH lt7AQjipg9mVB m4ccI5wg36nRmY0NYCz3zFAespHF3 mYDyHA2yEyyuMupqseLoorM nhky63WMy niVUHtfOxzC8vEu906K8s0KyyTOxlR nuXP03IeRx oEtWNI6xk2Drb540Xdq1uXFQE4g oJjKJZ8E5KzOcfhl ogllKR6sFTpJ oqxTgrQOwWa00lYhbVgF2ArP0cF pT05IJJS3fTz54aQwssMRtYz28U6di plGoZ6YtsfNq psl_builtin psl_builtin_file_time psl_builtin_filename psl_builtin_outdated psl_builtin_sha1sum psl_check_version_number psl_dist_filename psl_free psl_free_string psl_get_version psl_is_cookie_domain_acceptable psl_is_public_suffix psl_is_public_suffix2 psl_latest psl_load_file psl_load_fp psl_registrable_domain psl_str_to_utf8lower psl_suffix_count psl_suffix_exception_count psl_suffix_wildcard_count psl_unregistrable_domain qQdg3Dk77Y rWwCTO7tFJmRse72V0rT0 sEYWL8JJvlNOHUNDef4FdKkl1FosP sQp2J10nrjxuEzpqxyZ9a2aG uh6xIuRKEMkt32pAZ4to55mEU urHRJWdhlG wiEjCsm5zfSLHQVKMk wnD4NbghO7pX xkBptfnq xuFO5hpYdtbGzZFotFArvd yJ9ce27FMF5uT1kbBZz zzNze83I6gwQDk

Name

.text

Size

762KB

Virtual Size

762KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

467KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

libpsl-5.dll.exe

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

secur32

user32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

vcruntime140

generic