legacybank updated[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
legacybank updated.dll
Size 3.9MB
Sample260802-dgjdbacc59
SHA256 32be431476a335746e89d1e59e4f1b7f8e47fd23b4aee2d6b85436c19619b2ab
MD5 af041bd6930e9a26d8503bc5f344c075
SHA1 13acb52d8b6166870cf15f8a94783541ea59e1b8
SHA512 d195303acf7a7bb769fb05f091c0fbb6f85c141aa5e12bef26504b59d2a44b8669bc8015580cec3b106b9579a618c172380c0371536912bae03813e6bcdf8e34
SSDEEP 49152:o4YhYoQKqmC8VDKmpOLD+BR6nBoqC+iJTO+VWyhQYYpKOeIq4FbX6lIHi8y+YLV/:okQlIHULBOfmF
TLSH
T1BB16BE0AB7A5016CD177E27AD957EA03EBB2B800076187CF3799166A5F273E01E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
legacybank updated.dll

File Explorer

legacybank updated.dll

.dll 3.9MB

legacybank updated.dll

IMPHASH 4b707f9d0db479b287a10efbabde68ce
SHA256 32be431476a335746e89d1e59e4f1b7f8e47fd23b4aee2d6b85436c19619b2ab
MD5 af041bd6930e9a26d8503bc5f344c075
SHA1 13acb52d8b6166870cf15f8a94783541ea59e1b8
SHA512 d195303acf7a7bb769fb05f091c0fbb6f85c141aa5e12bef26504b59d2a44b8669bc8015580cec3b106b9579a618c172380c0371536912bae03813e6bcdf8e34
SSDEEP 49152:o4YhYoQKqmC8VDKmpOLD+BR6nBoqC+iJTO+VWyhQYYpKOeIq4FbX6lIHi8y+YLV/:okQlIHULBOfmF
TLSH
T1BB16BE0AB7A5016CD177E27AD957EA03EBB2B800076187CF3799166A5F273E01E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1832812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\ivanp\OneDrive\Рабочий стол\aspect.cc\x64\bankroll-release.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetLocalTime GetCurrentProcessId CreateDirectoryA VirtualQuery SetUnhandledExceptionFilter OutputDebugStringA GetModuleHandleA GetTickCount64 GetProcAddress MultiByteToWideChar WideCharToMultiByte GetModuleHandleExA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo HeapCreate VirtualProtect HeapFree Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc HeapDestroy GetThreadContext FlushInstructionCache CloseHandle OpenThread GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW GetLastError FormatMessageA DisableThreadLibraryCalls GetLocaleInfoEx CreateDirectoryW FindFirstFileExW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead CreateFileA Sleep CreateThread GetCurrentThreadId FreeLibraryAndExitThread GetCurrentProcess GetModuleFileNameA LocalFree SetThreadContext

user32

ShowCursor RegisterClassExA SetWindowLongPtrA GetAsyncKeyState GetClientRect CreateWindowExA DefWindowProcA GetForegroundWindow UnregisterClassA CallWindowProcA GetKeyState ScreenToClient GetCapture DestroyWindow CharLowerW SetCursor ClipCursor LoadCursorA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCapture TrackMouseEvent ClientToScreen MessageBoxA

shell32

ShellExecuteA

msvcp140

?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Query_perf_frequency _Query_perf_counter ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

dbghelp

MiniDumpWriteDump

winmm

waveOutClose waveOutUnprepareHeader PlaySoundA waveOutOpen waveOutWrite waveOutPrepareHeader

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __std_type_info_destroy_list __current_exception_context __current_exception strrchr __std_exception_destroy longjmp memchr memcmp __C_specific_handler memset __std_exception_copy __std_terminate memmove memcpy _CxxThrowException _purecall strchr strstr

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free

api-ms-win-crt-stdio-l1-1-0

_fseeki64 _get_stream_buffer_pointers __stdio_common_vsprintf fsetpos ungetc ftell __acrt_iob_func getc freopen fopen setvbuf feof fseek fgetpos fwrite tmpnam fputs clearerr fgetc fclose fflush fputc _popen __stdio_common_vsprintf_s fgets __stdio_common_vfprintf _wfopen _pclose __stdio_common_vsscanf __stdio_common_vfscanf tmpfile fread ferror

api-ms-win-crt-filesystem-l1-1-0

rename _lock_file _unlock_file remove

api-ms-win-crt-string-l1-1-0

strpbrk strlen strncmp tolower strcmp isalpha strcspn strncat strncpy isspace isupper islower isxdigit strncpy_s ispunct strcoll strcpy_s wcslen toupper isdigit isalnum iscntrl

api-ms-win-crt-convert-l1-1-0

atoi strtoull strtoll strtol strtod strtoul

api-ms-win-crt-math-l1-1-0

ceilf _dclass _fdclass floorf _dsign lroundf roundf tanh tan sqrt sinh sin log10 log fmod exp cosh cos sinf ceil atan2 atan asin acos floor pow modf ldexp frexp sqrtf acosf cosf fmodf

api-ms-win-crt-time-l1-1-0

strftime _localtime64_s _gmtime64 _time64 _mktime64 _localtime64 clock _difftime64

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-locale-l1-1-0

setlocale localeconv ___lc_codepage_func

api-ms-win-crt-runtime-l1-1-0

terminate _invalid_parameter_noinfo_noreturn strerror _initterm_e system _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll abort _errno exit

api-ms-win-crt-environment-l1-1-0

getenv