Memlib[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Memlib.dll
Size 11.6MB
Sample260730-bmpfeazvdw
SHA256 c9b39bed368f989fdc89659c79176ad3bde3b6e25239c5647aa16f7dee5d1f55
MD5 ac3c802143ce24db4639ae920be5278e
SHA1 8ca26dccf4edd38b9d4339f82a82a59c0aa25183
SHA512 be66d66e9d71ee9dded7179d523d702483fe69e54f2e71ca3a73c7a0aae395d5323d482db3d7487e75bb4013a5c24e0f3c5eaafad9c05a8789d5078370c5fc74
SSDEEP 196608:8/jEUoJMap13yGysZmKtGf2KkECP/lOgUZGCFQ6Mh8RB63BX5cnZ5TOE+415I7v:CEUo5AuZRCzADUvQ6e8RBWBXOnLOEj1
TLSH
T195C6333326B02244D8E5C939CF33FC7532F3026B968169FD859B2AC576965A49B13F83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Memlib.dll

File Explorer

Memlib.dll

.dll 11.6MB

Memlib.dll

IMPHASH b35647a494418b4a3c4353e222068f34
SHA256 c9b39bed368f989fdc89659c79176ad3bde3b6e25239c5647aa16f7dee5d1f55
MD5 ac3c802143ce24db4639ae920be5278e
SHA1 8ca26dccf4edd38b9d4339f82a82a59c0aa25183
SHA512 be66d66e9d71ee9dded7179d523d702483fe69e54f2e71ca3a73c7a0aae395d5323d482db3d7487e75bb4013a5c24e0f3c5eaafad9c05a8789d5078370c5fc74
SSDEEP 196608:8/jEUoJMap13yGysZmKtGf2KkECP/lOgUZGCFQ6Mh8RB63BX5cnZ5TOE+415I7v:CEUo5AuZRCzADUvQ6e8RBWBXOnLOEj1
TLSH
T195C6333326B02244D8E5C939CF33FC7532F3026B968169FD859B2AC576965A49B13F83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13481772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

send

crypt32

CertFindCertificateInStore

advapi32

RegCloseKey

msvcp140

?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

bcrypt

BCryptGenRandom

kernel32

GetFileType VirtualQuery LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

BlockInput GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

shell32

ShellExecuteA

userenv

UnloadUserProfile

rpcrt4

RpcStringFreeA

wininet

InternetCloseHandle

urlmon

URLDownloadToFileA

psapi

GetProcessMemoryInfo

vcruntime140

__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_write

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-time-l1-1-0

asctime

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

dsound0

Size

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

dsound1

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Memlib.dll

ws2_32

crypt32

advapi32

msvcp140

bcrypt

kernel32

user32

shell32

userenv

rpcrt4

wininet

urlmon

psapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

wtsapi32

generic