version[.]dll | Triage™

General

Target
version.dll
Size 236KB
Sample260722-2wr6rsssdx
SHA256 ab07c6fd5686492aacf9d3b38bdeb40e855440be33b86d3a548ca5ce756391ec
MD5 14701672bf7095c8ed5ba92f6dce577e
SHA1 170b33cbbecc8409593953ba664fd41fa944e66f
SHA512 9ccfb163d6609cc37b94aea5e4a372932bd23505b58a93ab27aeaceae5e1eb69b1e8e5bc5afd029fc6d0585abfd39938e6732594451780f5a07468c59901e502
SSDEEP 6144:A40sNeI4OR2ER7r4Gyxmplns4kw8I0GEGUgsTRdJ1htZdSFxyBNtdQrds4Cx6G:A40sHd2A
TLSH
T148341853FAD406A7EA8B813085E31C41AF7BB2643327538F1AF55320BE6B3756E87254
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 236KB

version.dll

IMPHASH 56aa1e7b90b620d05cc9c0213ed401ba
SHA256 ab07c6fd5686492aacf9d3b38bdeb40e855440be33b86d3a548ca5ce756391ec
MD5 14701672bf7095c8ed5ba92f6dce577e
SHA1 170b33cbbecc8409593953ba664fd41fa944e66f
SHA512 9ccfb163d6609cc37b94aea5e4a372932bd23505b58a93ab27aeaceae5e1eb69b1e8e5bc5afd029fc6d0585abfd39938e6732594451780f5a07468c59901e502
SSDEEP 6144:A40sNeI4OR2ER7r4Gyxmplns4kw8I0GEGUgsTRdJ1htZdSFxyBNtdQrds4Cx6G:A40sHd2A
TLSH
T148341853FAD406A7EA8B813085E31C41AF7BB2643327538F1AF55320BE6B3756E87254
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

version.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx SetLastError MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleMode SetFileInformationByHandle InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId HeapAlloc HeapFree MapViewOfFile CreateFileMappingW VirtualAlloc GetSystemInfo UnmapViewOfFile VirtualFree VirtualQuery SetFileTime CreateFileW GetConsoleOutputCP VirtualProtect GetLastError GetNativeSystemInfo HeapReAlloc GetProcessHeap GetSystemDirectoryA LoadLibraryW GetProcAddress LoadLibraryA CloseHandle FreeLibrary GetModuleFileNameW GetFullPathNameW WaitForSingleObject QueryPerformanceCounter GetCurrentProcessId

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

vcruntime140

memcpy memcmp memmove memset __C_specific_handler __std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

fgetc __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _initterm_e _initterm _initialize_onexit_table _execute_onexit_table _cexit _initialize_narrow_environment _configure_narrow_argv

CloseDriver DefDriverProc DllMain DriverCallback DrvGetModuleHandle GetDriverModuleHandle GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW HidD_FlushQueue HidD_FreePreparsedData HidD_GetAttributes HidD_GetConfiguration HidD_GetFeature HidD_GetHidGuid HidD_GetIndexedString HidD_GetInputReport HidD_GetManufacturerString HidD_GetMsGenreDescriptor HidD_GetNumInputBuffers HidD_GetPhysicalDescriptor HidD_GetPreparsedData HidD_GetProductString HidD_GetSerialNumberString HidD_Hello HidD_SetConfiguration HidD_SetFeature HidD_SetNumInputBuffers HidD_SetOutputReport HidP_GetButtonCaps HidP_GetCaps HidP_GetData HidP_GetExtendedAttributes HidP_GetLinkCollectionNodes HidP_GetScaledUsageValue HidP_GetSpecificButtonCaps HidP_GetSpecificValueCaps HidP_GetUsageValue HidP_GetUsageValueArray HidP_GetUsages HidP_GetUsagesEx HidP_GetValueCaps HidP_InitializeReportForID HidP_MaxDataListLength HidP_MaxUsageListLength HidP_SetData HidP_SetScaledUsageValue HidP_SetUsageValue HidP_SetUsageValueArray HidP_SetUsages HidP_TranslateUsagesToI8042ScanCodes HidP_UnsetUsages HidP_UsageListDifference OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW WOWAppExit auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion sndPlaySoundA sndPlaySoundW timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite

Sharing