2020[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
2020.dll
Size 207KB
Sample260720-be9flsdv5w
SHA256 f537cdf8318bd14eeea6a1edbe12db4702d60522b7d5cc502d8beacbd39511b2
MD5 f00b07bfb1cd564ecb10d92694b74226
SHA1 402da22d01348be7587f566954bb514b9f7301f6
SHA512 cb31cd1394b069c9dd3f78b40b4885813c700028d98135e1222eac860c67f69406ceb83da4c8732b18441968f90c0cdda57fb5debf2ea8d225de50d024fbc301
SSDEEP 6144:lhWtypy5obGaAWBchsd9wZgkNy7WHNQMyZJ6chsS:lhWtyU5obGaXB+E9wdy6yMyX8
TLSH
T1B8248D21FC83803EDD950AB281BD4EB6197C869A67E554EBF7C02C714C695E33B39A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2020.dll

File Explorer

2020.dll

.dll 207KB

2020.dll

IMPHASH 4ea715d893d36f9347706a40b902e6c9
SHA256 f537cdf8318bd14eeea6a1edbe12db4702d60522b7d5cc502d8beacbd39511b2
MD5 f00b07bfb1cd564ecb10d92694b74226
SHA1 402da22d01348be7587f566954bb514b9f7301f6
SHA512 cb31cd1394b069c9dd3f78b40b4885813c700028d98135e1222eac860c67f69406ceb83da4c8732b18441968f90c0cdda57fb5debf2ea8d225de50d024fbc301
SSDEEP 6144:lhWtypy5obGaAWBchsd9wZgkNy7WHNQMyZJ6chsS:lhWtyU5obGaXB+E9wdy6yMyX8
TLSH
T1B8248D21FC83803EDD950AB281BD4EB6197C869A67E554EBF7C02C714C695E33B39A03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

176055

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\ard24\source\repos\PekoreWare2020+\Release\PekoraWare2020+.pdb

kernel32

ReadFile CreateNamedPipeA VirtualFree VirtualAlloc DisconnectNamedPipe GetSystemInfo IsBadReadPtr AllocConsole VirtualQuery ConnectNamedPipe AddVectoredExceptionHandler GetModuleFileNameA GetLastError LoadLibraryA GetProcAddress FreeLibrary FormatMessageA AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ReleaseSRWLockExclusive

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xout_of_range@std@@YAXPBD@Z

wininet

InternetCloseHandle InternetReadFile InternetOpenA InternetOpenUrlA

vcruntime140

memchr memcpy memmove memset longjmp _CxxThrowException __std_type_info_destroy_list strrchr strchr strstr __std_exception_destroy __std_exception_copy _except_handler4_common __CxxFrameHandler3 _setjmp3

api-ms-win-crt-stdio-l1-1-0

ferror fflush ftell fgets fputs fread feof __stdio_common_vfprintf clearerr fopen fclose ungetc getc __stdio_common_vsprintf tmpnam fseek _pclose __acrt_iob_func freopen tmpfile fwrite setvbuf __stdio_common_vfscanf _popen

api-ms-win-crt-runtime-l1-1-0

_beginthreadex system _initialize_narrow_environment _initterm_e terminate _initterm _cexit strerror _crt_atexit exit _execute_onexit_table _register_onexit_function _initialize_onexit_table _errno _seh_filter_dll _configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free

api-ms-win-crt-convert-l1-1-0

strtoul strtod

api-ms-win-crt-string-l1-1-0

iscntrl isdigit strcspn strncpy isalnum isalpha strcoll islower ispunct isxdigit isspace tolower isupper toupper strpbrk strncat

api-ms-win-crt-locale-l1-1-0

setlocale localeconv

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise _libm_sse2_exp_precise _CIsinh _libm_sse2_atan_precise _libm_sse2_log10_precise _CIfmod _libm_sse2_asin_precise _CIcosh ldexp frexp _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _CItanh ceil modf _libm_sse2_acos_precise _libm_sse2_log_precise floor _CIatan2 _libm_sse2_tan_precise

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_mktime64 _difftime64 clock _gmtime64 _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

rename remove