284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8.dll
Size 1.6MB
Sample260803-r2laass1gs
SHA256 284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8
MD5 af22e6e224031f90c8e295df4992d376
SHA1 aa48d19d085366b44cff797d87fab1ded4ee6c41
SHA512 ffff1f2f822a098595554d634be7e5187d444297d1efc5dfb36f40d0c997f09640875f4bb6744c7d5b266ef87640e182047f41dc499d120f587ea4911385b317
SSDEEP 12288:WM7LY2SaNXjP2/x2w/6roBJfQkxDpog+fbfUpTjUbDJ1sGlQpLp:h7zJjP252w/6rutl+fbfUpTQ2GlQ/
TLSH
T155754B13B389F93EE0AB0E364967D444983BFB716906CC47A7E4090CCE3D5546E3AAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8.dll

File Explorer

284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8.dll

.dll 1.6MB

284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8.dll

IMPHASH 1f365d4e2c37b47fb208b089b5f61d49
SHA256 284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8
MD5 af22e6e224031f90c8e295df4992d376
SHA1 aa48d19d085366b44cff797d87fab1ded4ee6c41
SHA512 ffff1f2f822a098595554d634be7e5187d444297d1efc5dfb36f40d0c997f09640875f4bb6744c7d5b266ef87640e182047f41dc499d120f587ea4911385b317
SSDEEP 12288:WM7LY2SaNXjP2/x2w/6roBJfQkxDpog+fbfUpTjUbDJ1sGlQpLp:h7zJjP252w/6rutl+fbfUpTQ2GlQ/
TLSH
T155754B13B389F93EE0AB0E364967D444983BFB716906CC47A7E4090CCE3D5546E3AAD6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1611156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetACP GetExitCodeProcess CloseHandle LocalFree TlsAlloc SetEnvironmentVariableW ReadProcessMemory TerminateThread QueryPerformanceFrequency IsDebuggerPresent VirtualFree SetThreadContext GetThreadContext GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW WriteProcessMemory GetLongPathNameW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread ExpandEnvironmentStringsW LoadLibraryExW TerminateProcess FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer SuspendThread GetTickCount GetTempFileNameW GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread VirtualAllocEx GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage TlsFree lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

wininet

InternetCloseHandle InternetReadFile HttpOpenRequestW HttpSendRequestW InternetConnectW InternetOpenW InternetOpenUrlW

bcrypt

BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty

ole32

CLSIDFromProgID CoInitializeEx CoInitialize CoCreateInstance CoUninitialize

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

msvcrt

memcpy

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

27KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

284cdb6ed51b1fe3a17a1f62b4f36ce83f28935f3fced506a8c0e6fc3a2cebc8.dll

kernel32

wininet

bcrypt

ole32

user32

oleaut32

msvcrt

advapi32

winhttp

generic