Fake heatmap[.]dll

General

Target
Fake heatmap.dll
Size 402KB
Sample260804-ex3mkacg86
SHA256 991e283cefc6cf3da4f4fd6b67105c1d1c934a1db64d34837c1c2cc80097b2d8
MD5 80f1b91e844cc7a5326903003c38e412
SHA1 3601e4273d076ca0f8c3f4fa0ebac30f228d32bb
SHA512 1e3a68088a6711365a1b97129118195def3261a7e6cac6595426763ab2d4095c292e13161b5d3fef919a55f430d5119d9c383b9676c9d1c34292e495c5fc4fa3
SSDEEP 6144:+7CXUSWBCaxsPgIAqF4tVjkYKLgqyc/taAZdCtnDHlS:oGioRquLtyW0PtDH
TLSH
T187944D3B9684156CE2B7D1B88E874C82EB3A740A07F19DFF0BD094935D535A49B3AB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Fake heatmap.dll

File Explorer

Fake heatmap.dll

.dll 402KB

Fake heatmap.dll

IMPHASH d0ce544e1e05afa6484aa0351ae4f8e5
SHA256 991e283cefc6cf3da4f4fd6b67105c1d1c934a1db64d34837c1c2cc80097b2d8
MD5 80f1b91e844cc7a5326903003c38e412
SHA1 3601e4273d076ca0f8c3f4fa0ebac30f228d32bb
SHA512 1e3a68088a6711365a1b97129118195def3261a7e6cac6595426763ab2d4095c292e13161b5d3fef919a55f430d5119d9c383b9676c9d1c34292e495c5fc4fa3
SSDEEP 6144:+7CXUSWBCaxsPgIAqF4tVjkYKLgqyc/taAZdCtnDHlS:oGioRquLtyW0PtDH
TLSH
T187944D3B9684156CE2B7D1B88E874C82EB3A740A07F19DFF0BD094935D535A49B3AB13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

237920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError Sleep GetTickCount FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA LocalFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList GetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

307KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Fake heatmap.dll

kernel32

generic