vsdbg[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vsdbg.dll.exe
Size 2.3MB
Sample260804-x6bvbaff95
SHA256 45880839303fe491b2676a37faaa1fe6192917b3e64de1d46858563f16518e2f
MD5 edf5eeed72c207be16d9119f87b6a70c
SHA1 4319a638252be2141e4878d709a60ac61168ccc2
SHA512 248b4e03640a9b70ed2d313b0dd1e3d59e96a895b51d57de1ccecb93628b8f6dd66835223de496f241a46efbdb245216cadcd94f961d5b7b933f7114bcec6d3b
SSDEEP 49152:BG4RmRcMlBRiFn8a8/S+pGUZRLoePOxDtlx14Svw+:csohpGUHPKDDUS
TLSH
T1FFB5DF29E3D912A8E567DA34CB626233D7B578160770E98F069DC2152F73ED0AB3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vsdbg.dll.exe

File Explorer

vsdbg.dll.exe

.dll 2.3MB

vsdbg.dll.exe

IMPHASH 7c15ad67c5cfe43a17beff396750ae2c
SHA256 45880839303fe491b2676a37faaa1fe6192917b3e64de1d46858563f16518e2f
MD5 edf5eeed72c207be16d9119f87b6a70c
SHA1 4319a638252be2141e4878d709a60ac61168ccc2
SHA512 248b4e03640a9b70ed2d313b0dd1e3d59e96a895b51d57de1ccecb93628b8f6dd66835223de496f241a46efbdb245216cadcd94f961d5b7b933f7114bcec6d3b
SSDEEP 49152:BG4RmRcMlBRiFn8a8/S+pGUZRLoePOxDtlx14Svw+:csohpGUHPKDDUS
TLSH
T1FFB5DF29E3D912A8E567DA34CB626233D7B578160770E98F069DC2152F73ED0AB3B311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

859408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertSidToStringSidW DeregisterEventSource GetTokenInformation ImpersonateLoggedOnUser OpenProcessToken RegCloseKey RegCreateKeyExW RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptGenRandom BCryptCloseAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptCreateHash

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList CancelIoEx CloseHandle CreateDirectoryW CreateEventExW CreateFileW CreateThread DuplicateHandle FindClose FindFirstFileW FindNextFileW FormatMessageW FreeConsole FreeLibrary GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetFileSize GetLastError GetModuleFileNameW GetProcAddress GetStdHandle GetThreadPriority GetTickCount64 IsDebuggerPresent LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ResumeThread SetEvent SetLastError SetNamedPipeHandleState SetThreadErrorMode SetThreadPriority Sleep VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ResetEvent SleepEx DebugBreak InitializeCriticalSection GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoWaitForMultipleHandles CoUninitialize CoTaskMemAlloc CoInitializeEx CoGetApartmentType CoTaskMemFree

secur32

DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle GetUserNameExW InitializeSecurityContextW QueryContextAttributesW QuerySecurityContextToken AcquireCredentialsHandleW AcceptSecurityContext

api-ms-win-crt-math-l1-1-0

ceil

api-ms-win-crt-string-l1-1-0

_stricmp strcpy_s wcsncmp strcmp strlen

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

_purecall memcpy memset memmove

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm terminate abort _configure_narrow_argv _cexit _seh_filter_dll _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free calloc