fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll
Size 1.7MB
Sample260802-j6bbwsfe89
SHA256 fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227
MD5 83bc8de74ba1fd989b9ccda6d04103b8
SHA1 f0bffa28f4c6e6da60d6fe0d13f805c185148ac2
SHA512 22587f1b392e0df7b0bff373addb7b01c1ed0e0d5a8cc6afe5a521146e3af4f9d8e4e44bbc7e2a39e0982061717cde95fa7e022ae3a15037b9d015a23a7854a8
SSDEEP 24576:17zJjP252w/6rutl+fbfUpTQ2GlQn1dAcFQU2:Flxc+f+U2bDAcaP
TLSH
T162856C13B389B93AE06B0E3A4927E544983FFB716906CC07A7E4094C8E3D5546E3E6D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll

File Explorer

fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll

.dll 1.7MB

fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll

IMPHASH 1f365d4e2c37b47fb208b089b5f61d49
SHA256 fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227
MD5 83bc8de74ba1fd989b9ccda6d04103b8
SHA1 f0bffa28f4c6e6da60d6fe0d13f805c185148ac2
SHA512 22587f1b392e0df7b0bff373addb7b01c1ed0e0d5a8cc6afe5a521146e3af4f9d8e4e44bbc7e2a39e0982061717cde95fa7e022ae3a15037b9d015a23a7854a8
SSDEEP 24576:17zJjP252w/6rutl+fbfUpTQ2GlQn1dAcFQU2:Flxc+f+U2bDAcaP
TLSH
T162856C13B389B93AE06B0E3A4927E544983FFB716906CC07A7E4094C8E3D5546E3E6D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1611156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetACP GetExitCodeProcess CloseHandle LocalFree TlsAlloc SetEnvironmentVariableW ReadProcessMemory TerminateThread QueryPerformanceFrequency IsDebuggerPresent VirtualFree SetThreadContext GetThreadContext GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW WriteProcessMemory GetLongPathNameW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread ExpandEnvironmentStringsW LoadLibraryExW TerminateProcess FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer SuspendThread GetTickCount GetTempFileNameW GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread VirtualAllocEx GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage TlsFree lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

wininet

InternetCloseHandle InternetReadFile HttpOpenRequestW HttpSendRequestW InternetConnectW InternetOpenW InternetOpenUrlW

bcrypt

BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty

ole32

CLSIDFromProgID CoInitializeEx CoInitialize CoCreateInstance CoUninitialize

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

msvcrt

memcpy

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

136KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll

kernel32

wininet

bcrypt

ole32

user32

oleaut32

msvcrt

advapi32

winhttp

generic