ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll
Size 1.7MB
Sample260802-j6b87afe95
SHA256 ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3
MD5 72b341521d22ceb4d5f2aeccf213ac3a
SHA1 35c8d1275df3dc0228d10e3f399b3a18a4fc8a9f
SHA512 2761791c1a4c45294558cffe6cc86130711c045d9898fef1eaa7fe37dfca316afa3aefd06a0cece72c77448cb5da1e81d8527583e38d2edaf6473fd00fd61ef8
SSDEEP 24576:D1v/FzzBX5jCMjQCsbuQISmaYJPshPK3By2Om9Mz1dAcFQU2:DNZOI1ewy2OzDAcaP
TLSH
T1B9854A13B2856139F09B0E3E8927A584993F777342018C87A7F45ACCCF69A536A2D377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll

File Explorer

ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll

.dll 1.7MB

ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll

IMPHASH 1f365d4e2c37b47fb208b089b5f61d49
SHA256 ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3
MD5 72b341521d22ceb4d5f2aeccf213ac3a
SHA1 35c8d1275df3dc0228d10e3f399b3a18a4fc8a9f
SHA512 2761791c1a4c45294558cffe6cc86130711c045d9898fef1eaa7fe37dfca316afa3aefd06a0cece72c77448cb5da1e81d8527583e38d2edaf6473fd00fd61ef8
SSDEEP 24576:D1v/FzzBX5jCMjQCsbuQISmaYJPshPK3By2Om9Mz1dAcFQU2:DNZOI1ewy2OzDAcaP
TLSH
T1B9854A13B2856139F09B0E3E8927A584993F777342018C87A7F45ACCCF69A536A2D377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1611156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetACP GetExitCodeProcess CloseHandle LocalFree TlsAlloc SetEnvironmentVariableW ReadProcessMemory TerminateThread QueryPerformanceFrequency IsDebuggerPresent VirtualFree SetThreadContext GetThreadContext GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW WriteProcessMemory GetLongPathNameW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread ExpandEnvironmentStringsW LoadLibraryExW TerminateProcess FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer SuspendThread GetTickCount GetTempFileNameW GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread VirtualAllocEx GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage TlsFree lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

wininet

InternetCloseHandle InternetReadFile HttpOpenRequestW HttpSendRequestW InternetConnectW InternetOpenW InternetOpenUrlW

bcrypt

BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty

ole32

CLSIDFromProgID CoInitializeEx CoInitialize CoCreateInstance CoUninitialize

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

msvcrt

memcpy

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

136KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll

kernel32

wininet

bcrypt

ole32

user32

oleaut32

msvcrt

advapi32

winhttp

generic