hibro[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hibro.dll
Size 1.6MB
Sample260809-tnstbst1bw
SHA256 1b7c135173aad8e101c7b332b691714c4642a3dfabc2eff13257e35699a74a5d
MD5 77711bb52ed632863a1d4ab4f94fffe5
SHA1 e4f4944b377b0b69457c58e94fa855c8e649e530
SHA512 c591c1845f32b09979ee126287f6293d6cb3c5dc71e99205691856d82c3c28c207a3a97638cac656501d1f693b897b7bd809101a1dbbb20c34f782254a25972f
SSDEEP 24576:SfJq9ZIRU9llfrfsFj4SqrgwaZsb+X6UFIoZueoVr:S6ZIRU9lRsJ4Ewaeb+X6O
TLSH
T1CD751917E6A295ECC53BD0748667A732FD70B85E41347E2E1B94DB311F20E60A72EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hibro.dll

File Explorer

hibro.dll

.dll 1.6MB

hibro.dll

IMPHASH fd587e532ffdeb07d60a4ccce42d574d
SHA256 1b7c135173aad8e101c7b332b691714c4642a3dfabc2eff13257e35699a74a5d
MD5 77711bb52ed632863a1d4ab4f94fffe5
SHA1 e4f4944b377b0b69457c58e94fa855c8e649e530
SHA512 c591c1845f32b09979ee126287f6293d6cb3c5dc71e99205691856d82c3c28c207a3a97638cac656501d1f693b897b7bd809101a1dbbb20c34f782254a25972f
SSDEEP 24576:SfJq9ZIRU9llfrfsFj4SqrgwaZsb+X6UFIoZueoVr:S6ZIRU9lRsJ4Ewaeb+X6O
TLSH
T1CD751917E6A295ECC53BD0748667A732FD70B85E41347E2E1B94DB311F20E60A72EB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

comdlg32

GetOpenFileNameW

crypt32

CryptBinaryToStringA CryptStringToBinaryA

gdi32

CreateBitmap DeleteObject

kernel32

AllocConsole AttachConsole CloseHandle CopyFileW CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitProcess ExitThread ExpandEnvironmentStringsW FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindNextFileW FindResourceA FindResourceExW FindResourceW FormatMessageA FreeConsole GetConsoleMode GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleTitleW SetCurrentDirectoryW SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

ntdll

RtlAddFunctionTable

ole32

CoInitializeEx

shell32

SHCreateDirectoryExW ShellExecuteA

shlwapi

PathFileExistsW PathRemoveFileSpecW

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbsrtowcs strtol strtoll strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file _wremove

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen fmod

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_assert _beginthreadex _endthreadex _errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _pclose _read _setmode _wfopen _wpopen _write fclose fflush fgetws fopen fputc fputs fread freopen fwrite getc getchar getwc putc putchar putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup isalnum isspace iswctype memset strcmp strcoll strcpy strlen strncmp strncpy strnlen strxfrm tolower towlower towupper wcscat wcscoll wcscpy wcslen wcsncpy wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

user32

CreateIconIndirect MessageBoxA SendMessageA SetForegroundWindow ShowWindow

winhttp

WinHttpCrackUrl

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hibro.dll

comdlg32

crypt32

gdi32

kernel32

ntdll

ole32

shell32

shlwapi

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

winhttp

generic