DLL (1)[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DLL (1).dll
Size 12.6MB
Sample260823-ee5dfadr5v
SHA256 dd927f2a15edaf4887202aa39ff9eb54a6b5abd66f2479d5962508aa9e344fba
MD5 7fdc4dd82b3b4d3ef9912a3bb8ff9f33
SHA1 e9c033a649cba50b11548bae1791d67af21947df
SHA512 6f46a1da05448278c6270364b2757e2265f856e6a4a87b0772351397939e98609a36dba0a2cb57ab4c2e35fd863f4dfbcabc1e51544b4567c2e27cf09c2e716f
SSDEEP 196608:0QelPN1UM2P4Ywe+i9bXpnqAiPO5jfaVRREtn7vyOhLdwm5uVCATDMeeyJ:WBS+i9DpnqdqDGu9f5ruV1fs
TLSH
T141D62306F2E7855DE363A83AC672D31786F5FC151F76A28B23406B67EEA7640CE56300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
DLL (1).dll

File Explorer

DLL (1).dll

.dll 12.6MB

DLL (1).dll

IMPHASH fd417f67cecd9d4d65b28e79bff60efd
SHA256 dd927f2a15edaf4887202aa39ff9eb54a6b5abd66f2479d5962508aa9e344fba
MD5 7fdc4dd82b3b4d3ef9912a3bb8ff9f33
SHA1 e9c033a649cba50b11548bae1791d67af21947df
SHA512 6f46a1da05448278c6270364b2757e2265f856e6a4a87b0772351397939e98609a36dba0a2cb57ab4c2e35fd863f4dfbcabc1e51544b4567c2e27cf09c2e716f
SSDEEP 196608:0QelPN1UM2P4Ywe+i9bXpnqAiPO5jfaVRREtn7vyOhLdwm5uVCATDMeeyJ:WBS+i9DpnqdqDGu9f5ruV1fs
TLSH
T141D62306F2E7855DE363A83AC672D31786F5FC151F76A28B23406B67EEA7640CE56300
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

40:c0:64:60:b2:d3:b1:73:d3:b7:f0:dd:36:a2:73:de:c0:23:df:80:01:d4:38:fe:c0:db:5f:3e:44:b0:3c:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN

Chains

Aug 20, 2026

CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN

Subject

CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN

Serial Number

28:77:79:fb:66:62:61:cb:73:17:47:92:9a:62:17:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2017 - Oct 13, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

566320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\YEDEK DOSYALAR\Bilgisayar\Spoofer & Bypass\Internal\imgui internla - ub\x64\Release\gooo\Sync.pdb

kernel32

EnterCriticalSection LeaveCriticalSection GetTickCount VirtualProtect VirtualQuery GlobalUnlock GlobalLock GlobalAlloc GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetModuleHandleW GetSystemInfo VirtualFree HeapCreate HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache CreateToolhelp32Snapshot Thread32First Thread32Next SetEndOfFile VirtualAlloc HeapSize CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW LoadLibraryW GetProcAddress GetModuleHandleA GetModuleFileNameW GetFileType GetStdHandle UnhandledExceptionFilter DisableThreadLibraryCalls CloseHandle GetTickCount64 CreateThread Sleep WriteConsoleW IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext ReleaseSRWLockExclusive AcquireSRWLockExclusive GetStringTypeW InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ReadFile IsProcessorFeaturePresent ExitProcess TerminateProcess GetModuleHandleExW RtlUnwind

user32

OpenClipboard CallNextHookEx SetWindowLongPtrW CallWindowProcW CloseClipboard DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW LoadCursorW ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard SetClipboardData GetCursorPos GetAsyncKeyState GetClipboardData

winmm

PlaySoundW

imm32

ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

763KB

Virtual Size

762KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

853KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11.0MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DLL (1).dll

PE Signature issue

kernel32

user32

winmm

imm32

d3dcompiler_47

generic