wzAudio[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wzAudio.dll
Size 208KB
Sample260820-wvgezsshqa
SHA256 4e103af4265081890ea8958b209b90416629c3ca50a7397f90f4df0781acb0db
MD5 2fe3b2efebc02746aa4e0634daae3036
SHA1 51c202995028e707d08300c50b4c760329ca4441
SHA512 6601bfc6441532ea4373a7d720b5b1ba91daa173885936c1736ab8953e4b052f5663363d51ee516808a1c46fefcbe5eb5acbc9f0033706a7e39a1ad16fcc0cbf
SSDEEP 3072:U4VUgiWs8HLPFvUJwtEUcDIeD5D69pF6RJtGB+jU6n4gPyOoNmY:8NN8HLdduUyIeD0FiGAn4Myrm
TLSH
T12E248D31EC60807AC3EA11FA6C9397B65B7A63D8C3DB9C43533CD85468275B0B627279
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wzAudio.dll

File Explorer

wzAudio.dll

.dll 208KB

wzAudio.dll

IMPHASH 2812bc594b86151ba488c2abfb4e07ec
SHA256 4e103af4265081890ea8958b209b90416629c3ca50a7397f90f4df0781acb0db
MD5 2fe3b2efebc02746aa4e0634daae3036
SHA1 51c202995028e707d08300c50b4c760329ca4441
SHA512 6601bfc6441532ea4373a7d720b5b1ba91daa173885936c1736ab8953e4b052f5663363d51ee516808a1c46fefcbe5eb5acbc9f0033706a7e39a1ad16fcc0cbf
SSDEEP 3072:U4VUgiWs8HLPFvUJwtEUcDIeD5D69pF6RJtGB+jU6n4gPyOoNmY:8NN8HLdduUyIeD0FiGAn4Myrm
TLSH
T12E248D31EC60807AC3EA11FA6C9397B65B7A63D8C3DB9C43533CD85468275B0B627279
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEvent EnterCriticalSection WaitForSingleObject GetModuleFileNameA GetFileAttributesA GetModuleHandleA CreateThread TerminateThread lstrcpynA SetFilePointer ReadFile CreateFileA FreeLibrary GetProcAddress LoadLibraryA FindClose FindNextFileA LeaveCriticalSection lstrcmpiA SetThreadPriority GetCurrentThread VirtualAlloc VirtualFree Sleep GetFileSize SetEnvironmentVariableA CompareStringW CompareStringA CloseHandle SetEndOfFile RaiseException FlushFileBuffers FindFirstFileA DeleteCriticalSection SetStdHandle InterlockedIncrement InterlockedDecrement CreateEventA InitializeCriticalSection lstrcpyA lstrcatA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA MultiByteToWideChar GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount UnhandledExceptionFilter GetCurrentProcess TerminateProcess WriteFile GetOEMCP GetACP lstrlenA GetCPInfo RtlUnwind ExitProcess HeapReAlloc HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA SetLastError TlsFree TlsAlloc GetVersion GetCommandLineA ExitThread TlsGetValue TlsSetValue GetCurrentThreadId GetTimeZoneInformation GetSystemTime GetLocalTime HeapAlloc HeapFree GetLastError

user32

MsgWaitForMultipleObjects DefWindowProcA DestroyWindow CreateWindowExA RegisterClassExA PostThreadMessageA PostMessageA SetTimer WaitMessage GetWindowLongA PeekMessageA

gdi32

DeleteObject

ole32

CoUninitialize CoInitialize

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey

winmm

waveOutGetNumDevs waveOutSetVolume waveOutPause waveOutWrite waveOutRestart waveOutReset waveOutUnprepareHeader waveOutPrepareHeader timeSetEvent timeKillEvent mixerGetControlDetailsA mixerSetControlDetails waveOutOpen mixerOpen mixerGetDevCapsA mixerGetLineInfoA mixerGetLineControlsA waveOutClose mixerClose

dsound

ord1

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetSetOptionA InternetReadFileExA

comdlg32

GetSaveFileNameA GetOpenFileNameA

vorbisfile

ov_time_total ov_bitrate ov_info ov_streams ov_open_callbacks ov_clear ov_pcm_seek ov_pcm_total ov_read ov_time_tell