SkidFinder[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SkidFinder.dll
Size 77KB
Sample260808-z56dmsvdkh
SHA256 bed0ee6c7e46d68b819d7beb2b4a3aaa2bf9f2059a1620d8ed448d5ffdaff172
MD5 de945efe33632dc95a2c900f9a668752
SHA1 79f48cd85f469a0b10da1750f503ec9c80ccd2ed
SHA512 7a4a18d4edd004395307509460fac8e8268624876a9dbf6742374e716417dee64a004745feae39872eaafab06c5dc44a646f147e3ba0cf651d5542778ec8084f
SSDEEP 768:q6xM03WvRONjVfV+lYT0qGftykrF+oNwGSh6izu/6JY4pWVijxV6P3V9XmZbKd0D:nWRONjVfoqwbwXMcNLjEXmZbKG45BvO
TLSH
T13A732B1A9916146EC3AA9D78CB5B0801CB35BC8787916BCFB7481CF54F2EAD4AF35E01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SkidFinder.dll

File Explorer

SkidFinder.dll

.dll 77KB

SkidFinder.dll

IMPHASH 96d2987a0591bd7d9581f4f55d39e84d
SHA256 bed0ee6c7e46d68b819d7beb2b4a3aaa2bf9f2059a1620d8ed448d5ffdaff172
MD5 de945efe33632dc95a2c900f9a668752
SHA1 79f48cd85f469a0b10da1750f503ec9c80ccd2ed
SHA512 7a4a18d4edd004395307509460fac8e8268624876a9dbf6742374e716417dee64a004745feae39872eaafab06c5dc44a646f147e3ba0cf651d5542778ec8084f
SSDEEP 768:q6xM03WvRONjVfV+lYT0qGftykrF+oNwGSh6izu/6JY4pWVijxV6P3V9XmZbKd0D:nWRONjVfoqwbwXMcNLjEXmZbKG45BvO
TLSH
T13A732B1A9916146EC3AA9D78CB5B0801CB35BC8787916BCFB7481CF54F2EAD4AF35E01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\SkidFinder-main\SkidFinder-main\x64\Release\SkidFinder.pdb

kernel32

GetModuleHandleA GetCurrentThread SuspendThread AllocConsole SetConsoleTitleA FreeLibraryAndExitThread CreateThread AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

user32

MessageBoxA

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memset memcpy memcmp __current_exception wcschr __std_exception_destroy __std_exception_copy __std_terminate memmove _CxxThrowException __current_exception_context __std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _crt_atexit _cexit _register_onexit_function _seh_filter_dll _initialize_narrow_environment _execute_onexit_table _initterm_e _initterm terminate _initialize_onexit_table _invoke_watson

api-ms-win-crt-convert-l1-1-0

wcstod strtoul

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func freopen_s

api-ms-win-crt-math-l1-1-0

floor

api-ms-win-crt-string-l1-1-0

strcmp