vsdbg[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vsdbg.dll
Size 3.1MB
Sample260717-aasfvsbx31
SHA256 4543006aca3bdc0e761d2c7bf36f2dedc6a54ed55e9e6cf9e09076955242a6b7
MD5 8bbb12edc473eb518502e2c2b2c2f9a5
SHA1 f6f315b6999bee0e1fef98f132e8cb5e99d18b7e
SHA512 9e1306d75a4bfeef624568c0308a8ae9e52de6421266dc5629ef6b041e01a0abe66d1d213f595a43e2b2e29284956c40fe52ccf251d6462bb5a84a031f7bd105
SSDEEP 49152:x1Nt0vu4eher3yr0NmZ4yYnJJuQkbooe/TBCs35yrNMBboYs26JNkx2iVvket+:Xveu50NcwQrNuUqIk4iV5t
TLSH
T178E5AD2F6EE44476EE168933D23B8333D6B876552637B96B0E86C2405E36E71032BD35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vsdbg.dll

File Explorer

vsdbg.dll

.dll 3.1MB

vsdbg.dll

IMPHASH ecc752e90ba285b090260711e7a950e4
SHA256 4543006aca3bdc0e761d2c7bf36f2dedc6a54ed55e9e6cf9e09076955242a6b7
MD5 8bbb12edc473eb518502e2c2b2c2f9a5
SHA1 f6f315b6999bee0e1fef98f132e8cb5e99d18b7e
SHA512 9e1306d75a4bfeef624568c0308a8ae9e52de6421266dc5629ef6b041e01a0abe66d1d213f595a43e2b2e29284956c40fe52ccf251d6462bb5a84a031f7bd105
SSDEEP 49152:x1Nt0vu4eher3yr0NmZ4yYnJJuQkbooe/TBCs35yrNMBboYs26JNkx2iVvket+:Xveu50NcwQrNuUqIk4iV5t
TLSH
T178E5AD2F6EE44476EE168933D23B8333D6B876552637B96B0E86C2405E36E71032BD35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

403208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW EventWrite EventRegister EventEnabled OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue CloseThreadpoolIo MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetLastError SetLastError GetFullPathNameW GetLongPathNameW GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW SetFileInformationByHandle SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW CreateDirectoryW FindFirstFileW FindNextFileW GetFileSize ReadFile FreeConsole GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoUninitialize CoInitializeEx CoGetApartmentType CoWaitForMultipleHandles CoCreateGuid

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

modf pow ceil

api-ms-win-crt-heap-l1-1-0

free calloc malloc _callnewh

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s strcmp _wcsicmp

vcruntime140

memcpy _purecall memmove memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table abort terminate _cexit _initterm _execute_onexit_table _initterm_e _initialize_narrow_environment _seh_filter_dll _configure_narrow_argv

Name

.text

Size

412KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1011KB

Virtual Size

1011KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

126KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.relov

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

vsdbg.dll

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

generic