FLTLIB[.]DLL | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FLTLIB.DLL
Size 33.3MB
Sample260819-al8bfstdlb
SHA256 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c
MD5 987ea6e787945b049b32c1bdb31b54aa
SHA1 da97a8cfeeecbc1af4d034bb877f9558840a4fe3
SHA512 dde8c30a6f8c925142afae743ba10cb8e2639a46f405919565f0a8f30e1270d8e16f342f587301783b6b75fc0a04cf8dd17546b7ffbaa9682e47c3b7aa6d3bf7
SSDEEP 196608:gBw90Fzm+TtnKz7Puu0cRzOeYT9UMeN/I5usq:gBw90FvTiT0S6eYTOMepxl
TLSH
T1D5778C05A39705ABD436DAF8CA3492F2F2B37D524636814B0959F63F1F73A504B3BA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FLTLIB.DLL

File Explorer

FLTLIB.DLL

.dll 33.3MB

FLTLIB.DLL

IMPHASH 2d4dda0786e1ceafdd51569972dea026
SHA256 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c
MD5 987ea6e787945b049b32c1bdb31b54aa
SHA1 da97a8cfeeecbc1af4d034bb877f9558840a4fe3
SHA512 dde8c30a6f8c925142afae743ba10cb8e2639a46f405919565f0a8f30e1270d8e16f342f587301783b6b75fc0a04cf8dd17546b7ffbaa9682e47c3b7aa6d3bf7
SSDEEP 196608:gBw90Fzm+TtnKz7Puu0cRzOeYT9UMeN/I5usq:gBw90FvTiT0S6eYTOMepxl
TLSH
T1D5778C05A39705ABD436DAF8CA3492F2F2B37D524636814B0959F63F1F73A504B3BA21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2457548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertSidToStringSidW DeregisterEventSource GetTokenInformation ImpersonateLoggedOnUser OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptCreateHash BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash

kernel32

K32GetProcessMemoryInfo GetProcessGroupAffinity GetNumaHighestNodeNumber IsProcessInJob VirtualAllocExNuma CloseHandle CloseThreadpoolWork CopyFileExW CreateDirectoryW CreateEventExW CreateFileW CreateThread CreateThreadpoolTimer CreateThreadpoolWork DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FormatMessageW FreeLibrary GetCPInfoExW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetProcAddress GetStdHandle GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadFile ResetEvent ResumeThread SetEvent SetLastError SetNamedPipeHandleState SetThreadErrorMode SetThreadPriority SetThreadpoolTimer Sleep SleepConditionVariableCS SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW ExitProcess TerminateProcess GetModuleHandleExW HeapFree HeapAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap RaiseException GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers SetFilePointerEx FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlRestoreContext VerSetConditionMask CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache CreateMemoryResourceNotification QueryInformationJobObject GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery SleepEx DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock

ole32

CoGetApartmentType CoInitializeEx CoUninitialize CoWaitForMultipleHandles CoCreateGuid

secur32

QuerySecurityContextToken InitializeSecurityContextW GetUserNameExW FreeCredentialsHandle FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleW AcceptSecurityContext QueryContextAttributesW

vcruntime140

memcpy __C_specific_handler_noexcept __CxxFrameHandler3 __std_terminate _purecall __std_type_info_destroy_list __std_exception_copy __std_exception_destroy __C_specific_handler _CxxThrowException memmove memset

vcruntime140_1

__CxxFrameHandler4

0gxIzGWfXGyzsNIigm4zESfZcO 0qVFw4t4nKbmKZ 1RKkWyY 1hAtHXwUiEu8PNMyO2 3ajo7LNc4fV0tg 3rMtQV466Fjv8 434fQmohFTewqgRzaJnirc 4lvapu8ISRHe 5Aa0ULyzgOHi4yftaCKa7UN0 5R2MwG9 71LmeQBm06SU0Gi6tifabD1EtP6 9XDfKdm Att5qBnaxnzqX6VXhOAvUSjol B4nXHSHIgtFgZQ3WFYEKfBe2LC3 CbSS3CnhePrr5 D5oNH8P7aLxTrTs F6llUNBrZC7zI6 FNriPW7wNK7qoKR3azpm2DKj9axPlH7 FilterAttach FilterAttachAtAltitude FilterClose FilterConnectCommunicationPort FilterCreate FilterDetach FilterFindClose FilterFindFirst FilterFindNext FilterGetDosName FilterGetInformation FilterGetMessage FilterInstanceClose FilterInstanceCreate FilterInstanceFindClose FilterInstanceFindFirst FilterInstanceFindNext FilterInstanceGetInformation FilterLoad FilterReplyMessage FilterSendMessage FilterUnload FilterVolumeClose FilterVolumeFindClose FilterVolumeFindFirst FilterVolumeFindNext FilterVolumeInstanceFindClose FilterVolumeInstanceFindFirst FilterVolumeInstanceFindNext G8IZ3QdHQ GYBPChW5eRcSCdb15DRbdzpAXrhrENZt GeVWLDzTVRRCnjI4rKFbMXxsTE5 J4au6QJJJK5 LEVA1csPdHEqlJaFUeXfGdZL LIRQicdqxli6zJGyWk7mMu0Eqc MPEHv8M NnVxEvzhwBOrUXLgztwag8At OebElvDlmGbDyaanpXQ1OFdpby RW8U0uzXZIht3X3yaTyisUk3FYiU6Y4 RgzcfRGSQNHtOGunD3oq7KKaw0eVk5 U6IPbLKlDiYNRqb8NmAXoezteF15 WENTbGiXhjfSmJRsqJ3wsYfYmCbF XhRTvffP3syG8i aJucplYhUsaokV3ArcghobM6MlFoz c9PUVcVezzRde78qPWsOdVCKFtTQiTj cJBF5t8OzPIM2cWfjs7hMgGmPzVII dzeYze03TaoFLAQL6Ntt eCnYKgorHUCyN emXA1aEW8IUFGrlm6S fqK2FvwX gFvNqSNETqhoIbNM11zfRMOQ gWVCu8y60 gYSSuQ37vqDAEZ3GscGVcp iLutykwxy jTrN26GNgx5xFNjuGuELwiR5VK lF0m864ebcdklSKRUNAgE9Cwx mEOS6aZFRR8LJhvgvt41BObOlVwdZ5iJ mapUusF nNVxMIQ0ei1yar4S4lcQq0GBrT nUR2qx0Yz ozd0yZu3go74WAx7kiuRXsjDQCU p9rq9VlL1EAC7VQcD41uU qU5bb3w82YHFNQVAaKDTUat snp81dL4WenaU58l1EzDHpuaYT7aGU2 t5SjiwU tl96FDr8 woD59SdP7 wwsIxeRAki5GK55FTGnzaQSq ylnnKoQ3 zvzaKE7Ne7rdEww0udfeI70uSE1

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FLTLIB.DLL

advapi32

bcrypt

kernel32

ole32

secur32

vcruntime140

vcruntime140_1

generic