s2 new[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
s2 new.dll
Size 7.7MB
Sample260808-wnxtdsbm5s
SHA256 dafe729a13a45d96f7464dc79aaa27dc4c73e1310a3f57475ee185de001aa7fb
MD5 4756b43afb24f8aa7fcb27175c4c7162
SHA1 a148ca5d9d4149dfc463a43ae591e1e39c646f93
SHA512 483e0480a27e589968da1a6d2007ed604e927b19ed8d298f06a150a9da376b2a0b1b3c47462e3446ed6c823f097411c9eb7541304602cf8c704f346c4698dd15
SSDEEP 98304:y4oBP+Yqsnh8wKHqNE0G5rJb2oDfgzAi1T4835qujzme8L9o4:cBPJWwKH8GBJBDfgzA4pqDPo
TLSH
T1B586234AB1B001F9D0BAD178DA87650BEA72385507718AFB13F04A652F737F056BBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
s2 new.dll

File Explorer

s2 new.dll

.dll 7.7MB

s2 new.dll

IMPHASH 4a11be70d0d4c0f42566fa65526eb495
SHA256 dafe729a13a45d96f7464dc79aaa27dc4c73e1310a3f57475ee185de001aa7fb
MD5 4756b43afb24f8aa7fcb27175c4c7162
SHA1 a148ca5d9d4149dfc463a43ae591e1e39c646f93
SHA512 483e0480a27e589968da1a6d2007ed604e927b19ed8d298f06a150a9da376b2a0b1b3c47462e3446ed6c823f097411c9eb7541304602cf8c704f346c4698dd15
SSDEEP 98304:y4oBP+Yqsnh8wKHqNE0G5rJb2oDfgzAi1T4835qujzme8L9o4:cBPJWwKH8GBJBDfgzA4pqDPo
TLSH
T1B586234AB1B001F9D0BAD178DA87650BEA72385507718AFB13F04A652F737F056BBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

916616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3d12

ord101

xinput1_4

ord2

kernel32

CreateEventW MultiByteToWideChar GetTickCount64 DisableThreadLibraryCalls CloseHandle CreateThread GetLocalTime GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA GetProcAddress GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FreeLibraryAndExitThread FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle SetFilePointerEx GetFileSizeEx ExitProcess ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount WaitForSingleObject GetModuleFileNameW GetModuleHandleExW GetModuleHandleW SetLastError InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent SetStdHandle HeapSize WriteConsoleW SetEndOfFile WriteFile IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep GetLastError HeapReAlloc HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId FlushInstructionCache SetThreadContext OpenThread VirtualFree VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter

user32

SendInput GetAsyncKeyState SetCursor mouse_event MessageBoxA MapVirtualKeyA ReleaseCapture GetKeyNameTextA OpenClipboard RegisterClassExW GetKeyState GetMessageExtraInfo ScreenToClient ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture GetClientRect IsWindowUnicode SetCursorPos GetCursorPos UnregisterClassW CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW CallWindowProcW MapVirtualKeyW DestroyWindow keybd_event SetWindowLongPtrW CreateWindowExW GetCapture

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

winmm

joyGetNumDevs joyGetPosEx

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

s2 new.dll

d3d11

d3d12

xinput1_4

kernel32

user32

shell32

ole32

imm32

d3dcompiler_47

winmm

generic