memoriam[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
memoriam.dll
Size 13.4MB
Sample260810-ebnaravtcz
SHA256 00400b97793eb9ff23145e56cd03fa7e977aa14222a2d9bcd8daddafbeea3178
MD5 72d2b17143f8124611b2585855bd35c2
SHA1 424a44076941761ccea2dee19eaf286f84afded2
SHA512 3d3abb323c9ad51ea7a7a5b027cfc43ec8016a49cc6b73ba92812eb73218e8cfe119a501a0ce3e35fd2a1ae6323a5780f6ce8786dbbb1ce61de7fca01f200138
SSDEEP 196608:/AhMbGr61oSLtGDlI6ekdcXUqcL4OLoyliWA8V91IbiD1bU+/Tr9T1H5UkaaGxJ8:/AhMiEoi+lWkd3qlO0+nx1bjTRp5D+
TLSH
T182E623E344C826A9D5CF8334E04E0B4EB0E1B7919EA6B609B7C68C43EA71FDB8545753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
memoriam.dll

File Explorer

memoriam.dll

.dll 13.4MB

memoriam.dll

IMPHASH 86df66fac4bfb4bf8b8127fb67b540d2
SHA256 00400b97793eb9ff23145e56cd03fa7e977aa14222a2d9bcd8daddafbeea3178
MD5 72d2b17143f8124611b2585855bd35c2
SHA1 424a44076941761ccea2dee19eaf286f84afded2
SHA512 3d3abb323c9ad51ea7a7a5b027cfc43ec8016a49cc6b73ba92812eb73218e8cfe119a501a0ce3e35fd2a1ae6323a5780f6ce8786dbbb1ce61de7fca01f200138
SSDEEP 196608:/AhMbGr61oSLtGDlI6ekdcXUqcL4OLoyliWA8V91IbiD1bU+/Tr9T1H5UkaaGxJ8:/AhMiEoi+lWkd3qlO0+nx1bjTRp5D+
TLSH
T182E623E344C826A9D5CF8334E04E0B4EB0E1B7919EA6B609B7C68C43EA71FDB8545753
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18511955

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.KgC

Size

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.KsN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

. _S

Size

13.4MB

Virtual Size

13.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

memoriam.dll

kernel32

user32

advapi32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic