wearedevs_exploit_api[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
wearedevs_exploit_api.dll
Size 6.5MB
Sample260727-1et4cssxdw
SHA256 8395222042500439f699fe10368ac6149e6e455134ea7a855a6dca249a725a13
MD5 394a86e73331ff6b5f9151229a55bdc6
SHA1 4b21d89f178f25b69e5d552eccf39bef6fc97689
SHA512 cd609e798edd8df98a93dc78595fa13bb81c266c65b52656e26062607a5584eebf6f65414123cee7f89aa4b29f494d32d5cf7c198f652809c58cbbddd237910f
SSDEEP 49152:KK2ylR0GZTx1mrKqf06jEN7TO/9F3iDe4mEhl5hXmAygTf8l23HLAA2SE0YS11JH:4zvFd9JxE5VNKlOSoD97
TLSH
T14F66D716A77960DAC17FC07892839B22BD21749D07393BF74991866A2F20FF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wearedevs_exploit_api.dll

File Explorer

wearedevs_exploit_api.dll

.dll 6.5MB

wearedevs_exploit_api.dll

IMPHASH ffdc802f2129bba4ff3c5a288fcee893
SHA256 8395222042500439f699fe10368ac6149e6e455134ea7a855a6dca249a725a13
MD5 394a86e73331ff6b5f9151229a55bdc6
SHA1 4b21d89f178f25b69e5d552eccf39bef6fc97689
SHA512 cd609e798edd8df98a93dc78595fa13bb81c266c65b52656e26062607a5584eebf6f65414123cee7f89aa4b29f494d32d5cf7c198f652809c58cbbddd237910f
SSDEEP 49152:KK2ylR0GZTx1mrKqf06jEN7TO/9F3iDe4mEhl5hXmAygTf8l23HLAA2SE0YS11JH:4zvFd9JxE5VNKlOSoD97
TLSH
T14F66D716A77960DAC17FC07892839B22BD21749D07393BF74991866A2F20FF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

wearedevs_exploit_api.pdb

user32

FindWindowA MessageBoxW IsWindowVisible

kernel32

GetProcAddress InitializeSListHead IsDebuggerPresent GetProcessHeap GetSystemTimeAsFileTime LoadLibraryExA HeapAlloc LoadLibraryExW FindNextFileW RtlVirtualUnwind HeapFree RtlCaptureContext SetFileCompletionNotificationModes QueryPerformanceCounter CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx SetThreadErrorMode GetModuleFileNameW CreateThread GetConsoleOutputCP GetStdHandle UnhandledExceptionFilter FreeLibrary SetUnhandledExceptionFilter CloseHandle SetHandleInformation WriteConsoleW MultiByteToWideChar K32GetPerformanceInfo CreateFileW QueryPerformanceFrequency GetSystemInfo GlobalMemoryStatusEx LocalFree SetCurrentDirectoryW GetModuleHandleA GetCurrentThreadId GetFullPathNameW GetModuleHandleW FormatMessageW RtlLookupFunctionEntry ReadProcessMemory GetConsoleMode FindClose VirtualQueryEx IsProcessorFeaturePresent GetSystemTimes GetProcessTimes GetLastError GetCurrentProcessId GetProcessIoCounters FindFirstFileExW GetSystemTimePreciseAsFileTime WaitForSingleObject GetFinalPathNameByHandleW DeleteFileW GetFileInformationByHandle SwitchToThread GetFileInformationByHandleEx CreateDirectoryW MoveFileExW GetEnvironmentVariableW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee OpenProcess SetFileInformationByHandle lstrlenW HeapReAlloc GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex

ntdll

RtlGetVersion NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtQueryInformationProcess NtQuerySystemInformation RtlNtStatusToDosError

ole32

CoTaskMemFree

oleaut32

GetErrorInfo SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

advapi32

IsValidSid GetLengthSid GetTokenInformation CopySid OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW

secur32

InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer DeleteSecurityContext DecryptMessage FreeCredentialsHandle QueryContextAttributesW ApplyControlToken AcquireCredentialsHandleA EncryptMessage

crypt32

CertEnumCertificatesInStore CertGetCertificateChain CertCloseStore CertDuplicateStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertFreeCertificateContext CertFreeCertificateChain CertOpenStore CertDuplicateCertificateChain CertVerifyCertificateChainPolicy

ws2_32

ioctlsocket getsockname getpeername setsockopt getsockopt closesocket WSAIoctl bind recv getaddrinfo WSASocketW connect shutdown WSAGetLastError WSACleanup WSAStartup send freeaddrinfo WSASend

pdh

PdhOpenQueryA PdhCloseQuery PdhGetFormattedCounterValue PdhEnumObjectsA PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW SHGetKnownFolderPath

powrprof

CallNtPowerInformation

vcruntime140

__CxxFrameHandler3 __std_type_info_destroy_list __C_specific_handler _CxxThrowException memcmp memmove memset memcpy

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _execute_onexit_table _cexit _initterm _initterm_e