mayr[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mayr.dll
Size 2.4MB
Sample260723-xsbmdshr9v
SHA256 fbe81e400978809c9ede75282379004d572f5e0b099ce1d0599bec726960e0f6
MD5 74e8911ff8e6040c47feda23ce5f655d
SHA1 93ae2950758b91f4f7c692cf6360b07110f96632
SHA512 c9cd47259fa09a7bb01e59c6cb33b76fba18e64150e74135082bf98e9d7dfe022ae4b0ad3135cc51195873ad362635b37c2b773d3dacf1bc55ab8767c6eff1d8
SSDEEP 49152:ifrpnmZ7KiwhS/GIcNmw+/JCZC0RgsjUi7TPbUmJq+mO654nDWnZe:MPyixYC
TLSH
T1FAC5AE19B2E900A9C077E17CEA87A513F732344603319AF713D19AA56FB73E15A7EE01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mayr.dll

File Explorer

mayr.dll

.dll 2.4MB

mayr.dll

IMPHASH 3aeb0651ac9f622fe35c9aff0c27ed23
SHA256 fbe81e400978809c9ede75282379004d572f5e0b099ce1d0599bec726960e0f6
MD5 74e8911ff8e6040c47feda23ce5f655d
SHA1 93ae2950758b91f4f7c692cf6360b07110f96632
SHA512 c9cd47259fa09a7bb01e59c6cb33b76fba18e64150e74135082bf98e9d7dfe022ae4b0ad3135cc51195873ad362635b37c2b773d3dacf1bc55ab8767c6eff1d8
SSDEEP 49152:ifrpnmZ7KiwhS/GIcNmw+/JCZC0RgsjUi7TPbUmJq+mO654nDWnZe:MPyixYC
TLSH
T1FAC5AE19B2E900A9C077E17CEA87A513F732344603319AF713D19AA56FB73E15A7EE01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1710620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\a1995\OneDrive\Документы\GitHub\mayrr_x32-64\x64\Release\mayrrx64-v2-release.pdb

kernel32

GetModuleHandleA RtlCaptureStackBackTrace MultiByteToWideChar GetTempPathA GetTickCount64 K32GetModuleFileNameExA GetLastError ReleaseSRWLockExclusive GetCurrentThread AcquireSRWLockExclusive LoadLibraryA LockResource QueryPerformanceFrequency ReleaseSRWLockShared K32GetModuleInformation LoadResource FindResourceW GetLocalTime GetCurrentDirectoryW SwitchToThread AddVectoredExceptionHandler GetThreadContext GetProcAddress MoveFileExW AcquireSRWLockShared GetCurrentProcessId GetModuleHandleW WideCharToMultiByte IsBadReadPtr SetThreadContext QueryPerformanceCounter GetTickCount VirtualQuery SetUnhandledExceptionFilter VirtualFree VirtualAlloc GetSystemInfo CreateMutexA CloseHandle HeapCreate HeapFree Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot GetTempPathW HeapReAlloc HeapAlloc FlushInstructionCache OpenThread OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA IsDBCSLeadByte VirtualProtect GetSystemTimeAsFileTime GetLocaleInfoEx FormatMessageA LocalFree GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentThreadId GetEnvironmentVariableW RtlLookupFunctionEntry GetModuleFileNameW GetCurrentProcess IsBadWritePtr GetModuleHandleExW SizeofResource InitializeSListHead Sleep

user32

DefWindowProcW GetKeyState GetMessageExtraInfo EmptyClipboard ScreenToClient GetCapture ClientToScreen CallWindowProcW SetWindowLongPtrW GetAsyncKeyState GetCursorInfo GetForegroundWindow GetClipboardData FindWindowW LoadCursorW SetCursor TrackMouseEvent GetKeyboardLayout SetCapture GetClientRect SetCursorPos IsWindowUnicode ReleaseCapture GetCursorPos OpenClipboard CloseClipboard SetClipboardData

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathW

msvcp140

__crtLCMapStringA _Xtime_get_ticks ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Facet_base@std@@UEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ _Mtx_trylock _Cnd_signal ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7facet@locale@std@@6B@ _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Query_perf_counter _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_type_info_destroy_list __current_exception_context __current_exception memset memmove memchr __C_specific_handler __std_exception_destroy __std_exception_copy __std_type_info_compare memcmp _purecall memcpy _set_se_translator strrchr strstr __RTtypeid strchr

api-ms-win-crt-stdio-l1-1-0

fread __stdio_common_vsscanf _fseeki64 _wfopen fsetpos __stdio_common_vsprintf _get_stream_buffer_pointers fopen_s ftell setvbuf fwrite fseek __stdio_common_vsnprintf_s __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s ungetc fclose fflush __acrt_iob_func fopen fputc fgetpos

api-ms-win-crt-heap-l1-1-0

malloc realloc _callnewh free

api-ms-win-crt-math-l1-1-0

logf lroundf fmaxf fminf atanf _fdclass _dclass llround tanf ceilf acosf asinf sqrtf sqrt floorf sin expf sinf cosf asin atan atan2 atan2f cos floor fmodf log pow powf

api-ms-win-crt-convert-l1-1-0

atoi atof strtof strtoull strtod strtol

api-ms-win-crt-string-l1-1-0

isblank toupper isdigit isspace strcat_s _stricmp strcpy_s isalnum _strnicmp tolower strncpy_s strncpy towlower strcmp strlen strncmp wcslen

api-ms-win-crt-runtime-l1-1-0

_errno terminate _initterm_e _initterm _cexit abort _crt_atexit _execute_onexit_table _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _beginthreadex

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func