mglobal[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mglobal.dll
Size 1.0MB
Sample260802-rb4c7athrh
SHA256 ba91deb9568dcb11c2943a57ae596cebd4fbe3d5a1e1967aa4ffb52296b565ea
MD5 c2d6795881b2444cc08e846e8fdb7d78
SHA1 bcacb91ef6c89026fd8712bf46c0f2390c90cd08
SHA512 fa6aaa33ab795133bbcb86b3e2e94d6d2d0849824827f48e3b7f5714f3d873de4d134c57d66db3930618a73456cb6d4310d1e049a6d402805e2500782307d649
SSDEEP 24576:ZgBrfn7t3nuk7IKbXYogxSMtY9GwyzA2l:ZgBzn7t3FsuYogxSv9JyU
TLSH
T199352917E2A748ECC52BC47487679772B931B86942347E7F1A94D7322F20E60976EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mglobal.dll

File Explorer

mglobal.dll

.dll 1.0MB

mglobal.dll

IMPHASH 4869c141b4b19e2a599ad9b37a2cd0cc
SHA256 ba91deb9568dcb11c2943a57ae596cebd4fbe3d5a1e1967aa4ffb52296b565ea
MD5 c2d6795881b2444cc08e846e8fdb7d78
SHA1 bcacb91ef6c89026fd8712bf46c0f2390c90cd08
SHA512 fa6aaa33ab795133bbcb86b3e2e94d6d2d0849824827f48e3b7f5714f3d873de4d134c57d66db3930618a73456cb6d4310d1e049a6d402805e2500782307d649
SSDEEP 24576:ZgBrfn7t3nuk7IKbXYogxSMtY9GwyzA2l:ZgBzn7t3FsuYogxSv9JyU
TLSH
T199352917E2A748ECC52BC47487679772B931B86942347E7F1A94D7322F20E60976EB30
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CloseServiceHandle EnumServicesStatusExW OpenSCManagerA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateEventA CreateFileW CreateHardLinkW CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindFirstVolumeW FindNextVolumeW FindVolumeClose FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetHandleInformation GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVolumeInformationW HeapAlloc HeapFree InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA LocalFree MoveFileExW OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFilePointer SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile

api-ms-win-crt-convert-l1-1-0

btowc mbrtowc mbsrtowcs mbstowcs strtoul wcrtomb wctob

api-ms-win-crt-environment-l1-1-0

_wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _wchdir _wchmod _wfindfirst64 _wfindnext64 _wfullpath _wmkdir _wstat64

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_assert _beginthreadex _endthreadex _errno _execute_onexit_table _exit _get_errno _initialize_onexit_table _initterm _initterm_e _register_onexit_function _set_errno abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf _close _fileno _get_osfhandle _lseeki64 _read _telli64 _wfopen _wopen _write fclose fflush fopen fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup iswctype memset strcat_s strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

user32

wsprintfW

Name

.text

Size

866KB

Virtual Size

865KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

137B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mglobal.dll

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

generic