Solstice 26[.]3X[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Solstice 26.3X.dll
Size 18.6MB
Sample260731-vgxdlsdf52
SHA256 53154d375be24ef7766663a29ed69272c33762ad7f9cdfda53129c8cec738a23
MD5 164a0ed1f188fa4a41122b56ab55d44e
SHA1 7333adb7d47d64796ff421cbc80c0d6285af429b
SHA512 8e333d93d7fa7aba7eaae84de216245b8429c3ffce45d3de184c24112ad4a112993acc077716aa0fed513d551ae3bb2d66443a61b739ccf8b4dbb104c3d43a61
SSDEEP 196608:R3hdxcKhNHGYbaEJEPdOR5jgxe54dDFzC4J+UZw9RWaiaWk:Rbx7hRGYbaAE42e5yDF+CItiaWk
TLSH
T1A717AE1A72998194E07BC07DCEC7CE57E6B238084B10A7DB16E0579D2F77EE8097A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Solstice 26.3X.dll

File Explorer

Solstice 26.3X.dll

.dll 18.6MB

Solstice 26.3X.dll

IMPHASH c665c5223a58c70f7c5233244c9bfa69
SHA256 53154d375be24ef7766663a29ed69272c33762ad7f9cdfda53129c8cec738a23
MD5 164a0ed1f188fa4a41122b56ab55d44e
SHA1 7333adb7d47d64796ff421cbc80c0d6285af429b
SHA512 8e333d93d7fa7aba7eaae84de216245b8429c3ffce45d3de184c24112ad4a112993acc077716aa0fed513d551ae3bb2d66443a61b739ccf8b4dbb104c3d43a61
SSDEEP 196608:R3hdxcKhNHGYbaEJEPdOR5jgxe54dDFzC4J+UZw9RWaiaWk:Rbx7hRGYbaAE42e5yDF+CItiaWk
TLSH
T1A717AE1A72998194E07BC07DCEC7CE57E6B238084B10A7DB16E0579D2F77EE8097A721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8698028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\MinecraftDEV\Solstice 1.26.2x\build\Release\Solstice.pdb

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

dbghelp

SymUnloadModule64 SymLoadModuleEx SymInitialize SymSetOptions SymGetModuleBase64 SymGetLineFromAddr64 SymFromAddr SymFunctionTableAccess64 StackWalk64 SymCleanup SymGetOptions

winmm

waveInOpen waveInPrepareHeader waveInClose waveInAddBuffer waveInStart waveInStop waveInUnprepareHeader

d3d12

ord101

d3d11

D3D11On12CreateDevice

d2d1

ord1

dxgi

CreateDXGIFactory

ole32

CoInitializeEx CoCreateInstance PropVariantClear CoInitialize CoUninitialize

kernel32

GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize DeleteFileW SetConsoleCtrlHandler GetTimeZoneInformation FlushFileBuffers GetFileSizeEx GetConsoleOutputCP ReadConsoleW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW MultiByteToWideChar GlobalLock WideCharToMultiByte GlobalUnlock GlobalAlloc GlobalFree CreateEventA WaitForSingleObject CloseHandle GetModuleHandleA LoadLibraryA GetProcAddress QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary VerSetConditionMask IsBadReadPtr VirtualProtect Sleep ExpandEnvironmentStringsA CreateFileA GetFileTime CompareFileTime VirtualFree VirtualQuery GetSystemInfo VirtualAlloc DeleteFileA FindFirstFileA FindNextFileA FindClose AllocConsole SetConsoleTitleA GetStdHandle GetConsoleMode SetConsoleMode FreeConsole GetModuleFileNameA K32GetModuleFileNameExA GetCurrentProcess K32GetModuleInformation GetLastError LoadLibraryExA SetFilePointer ReadFile CreateToolhelp32Snapshot GetCurrentProcessId Module32First TlsFree GetCurrentThreadId FreeEnvironmentStringsW GetTickCount64 GetModuleHandleExW GetModuleHandleW AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureContext DisableThreadLibraryCalls CreateThread GetFileAttributesA GetDynamicTimeZoneInformation WriteConsoleW WriteFile WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute HeapCreate HeapFree Thread32Next Thread32First SuspendThread ResumeThread HeapReAlloc HeapAlloc HeapDestroy GetThreadContext FlushInstructionCache SetThreadContext OpenThread SetLastError GetThreadTimes InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection SetStdHandle EnterCriticalSection CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce InitializeCriticalSectionEx WaitForThreadpoolWorkCallbacks CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetEndOfFile LoadLibraryExW FreeLibraryWhenCallbackReturns ExitProcess ExitThread RtlUnwind TlsAlloc TlsGetValue GetCurrentThread TlsSetValue FreeLibraryAndExitThread Module32Next GetDateFormatW IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleFileNameW GetFileType FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW LocalFree GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader RaiseException RtlCaptureStackBackTrace IsProcessorFeaturePresent InitOnceBeginInitialize InitOnceComplete

user32

RegisterClassExA EnumWindows GetWindowTextA GetWindowRect SetWindowTextA GetDpiForWindow SetWindowLongPtrW CallWindowProcW MessageBoxA ShowCursor ClipCursor MonitorFromWindow ReleaseDC GetDC IsWindowUnicode CreateWindowExA SetCapture GetCapture SetProcessDPIAware TrackMouseEvent GetMessageExtraInfo SetCursorPos ClientToScreen GetForegroundWindow GetKeyState LoadCursorA SetCursor SetClipboardData EmptyClipboard CloseClipboard GetClipboardData OpenClipboard DefWindowProcA DestroyWindow UnregisterClassA ReleaseCapture ScreenToClient

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

vcomp140

_vcomp_for_static_simple_init _vcomp_fork _vcomp_for_static_end

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6.7MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

627KB

Virtual Size

626KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Solstice 26.3X.dll

version

dbghelp

winmm

d3d12

d3d11

d2d1

dxgi

ole32

kernel32

user32

gdi32

advapi32

imm32

d3dcompiler_47

dwmapi

bcrypt

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

oleaut32

vcomp140

generic