PhoneOdms[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PhoneOdms.dll
Size 21KB
Sample260717-rrls3sds2n
SHA256 01bd54ba6e8b1bf7a5cd26ba1076408d46ad15686e18b2c17949519eb5267c2a
MD5 bd573b3d46a429544f92c08fa204ffe3
SHA1 5375a50a902ca52fa7a67ce0ae7dbb277ec31f72
SHA512 236c0ec797e1912e088c83b2a6bc23d9546285d8650e0f74282bca1977fc08e4e15b35007cc24447270a2480b24dd06766483f8bfe84153615a19367a3ec3588
SSDEEP 384:b1wNoXkpsujH5GEf684Rz/5EfGhj+PHHAH9aOmT:eSujHgN84cfGYHnO
TLSH
T154A2186FB71908ADE56BB1FC85E36F0AD231B41A0762A6CF13D0461B1E97BD4383E851
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PhoneOdms.dll

File Explorer

PhoneOdms.dll

.dll 21KB

PhoneOdms.dll

IMPHASH 9831142e36fa8d0c04f7f6d18aa33636
SHA256 01bd54ba6e8b1bf7a5cd26ba1076408d46ad15686e18b2c17949519eb5267c2a
MD5 bd573b3d46a429544f92c08fa204ffe3
SHA1 5375a50a902ca52fa7a67ce0ae7dbb277ec31f72
SHA512 236c0ec797e1912e088c83b2a6bc23d9546285d8650e0f74282bca1977fc08e4e15b35007cc24447270a2480b24dd06766483f8bfe84153615a19367a3ec3588
SSDEEP 384:b1wNoXkpsujH5GEf684Rz/5EfGhj+PHHAH9aOmT:eSujHgN84cfGYHnO
TLSH
T154A2186FB71908ADE56BB1FC85E36F0AD231B41A0762A6CF13D0461B1E97BD4383E851
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Admin\Desktop\aimnote\x64\Release\aimnote.pdb

kernel32

CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle WriteProcessMemory OpenProcess VirtualQueryEx GetSystemInfo ReadProcessMemory QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

user32

RegisterHotKey UnregisterHotKey GetMessageW

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ _Cnd_do_broadcast_at_thread_exit ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xlength_error@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_detach ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

ntdll

ZwReadVirtualMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_type_info_destroy_list memset __std_exception_destroy __std_terminate _CxxThrowException __std_exception_copy memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit _execute_onexit_table _register_onexit_function _initterm_e terminate _initialize_onexit_table _crt_atexit _initialize_narrow_environment _beginthreadex _configure_narrow_argv _seh_filter_dll _initterm

api-ms-win-crt-string-l1-1-0

strlen _wcsicmp

api-ms-win-crt-heap-l1-1-0

_callnewh _msize malloc free