velocs2[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
velocs2.dll
Size 5.7MB
Sample260808-aek8caej2w
SHA256 b16219843febe842142f40c628f2b040cb3bafa0688a7ef14362dbbef9637dbc
MD5 05dc980a02b212e0660b0c16d4b30cf4
SHA1 b5d5889fb505a31da08740873be257f7e8353dc4
SHA512 09a2601e77c85c77f4e901f059b3c784c1d6dbe1781bba21f9172ba8d04c1ddcd49eb033cd5d0496e8d2e85369a35367ef5187c04f512bba32d62af12ade952d
SSDEEP 98304:LM/TvrmP1Rhi6uBXrwn8g83j/nDf4PUvR:gvSPLoJrwn8Lz/nj4cZ
TLSH
T15756CF17F392A0ADD41AE2749657D337E337B8451B3226CB06885E25BEA37D02B34793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
velocs2.dll

File Explorer

velocs2.dll

.dll 5.7MB

velocs2.dll

IMPHASH b92e75ed1b11c47b21f2033ee43516dd
SHA256 b16219843febe842142f40c628f2b040cb3bafa0688a7ef14362dbbef9637dbc
MD5 05dc980a02b212e0660b0c16d4b30cf4
SHA1 b5d5889fb505a31da08740873be257f7e8353dc4
SHA512 09a2601e77c85c77f4e901f059b3c784c1d6dbe1781bba21f9172ba8d04c1ddcd49eb033cd5d0496e8d2e85369a35367ef5187c04f512bba32d62af12ade952d
SSDEEP 98304:LM/TvrmP1Rhi6uBXrwn8g83j/nDf4PUvR:gvSPLoJrwn8Lz/nj4cZ
TLSH
T15756CF17F392A0ADD41AE2749657D337E337B8451B3226CB06885E25BEA37D02B34793
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1658736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\alena\cs\projectss\velocity-main\velocity-main\cs2\velocity-cs2\..\velocs2.pdb

shell32

SHGetFolderPathW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CreateDirectoryW CreateFile2 CreateFileA CreateFileMappingA CreateThread DisableThreadLibraryCalls FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FindResourceW FormatMessageA GetCurrentProcess GetCurrentThreadId GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetLastError GetLocalTime GetLocaleInfoEx GetModuleHandleW GetProcAddress GetProcessHeap GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeSListHead LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared SizeofResource SleepConditionVariableSRW UnmapViewOfFile WakeAllConditionVariable WideCharToMultiByte

user32

CloseClipboard EmptyClipboard GetClipboardData GetCursorPos GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW MessageBoxA OpenClipboard SetClipboardData SetCursor SetCursorPos

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal PropVariantClear

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??1ios_base@std@@UEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Cnd_signal _Cnd_wait _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_hardware_concurrency

vcruntime140

_CxxThrowException __C_specific_handler __RTDynamicCast __intrinsic_setjmp __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_destroy_list _purecall longjmp memchr memcmp memcpy memmove memset strrchr strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _fseeki64 _get_stream_buffer_pointers fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-math-l1-1-0

_dsign _fdsign _ldsign acosf asinf atan2f atanf ceilf cosf expf floorf fmaf fmodf ilogbf logf modff pow powf remainderf roundf scalbnf sinf sqrt sqrtf tanf

api-ms-win-crt-runtime-l1-1-0

_cexit _configure_narrow_argv _crt_atexit _errno _execute_onexit_table _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_strnicmp isalnum strcmp strcpy strlen strncmp strncpy strncpy_s tolower wcslen

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoul strtoull

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

888KB

Virtual Size

888KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

38B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

887KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

velocs2.dll

shell32

kernel32

user32

advapi32

ole32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic