trigger_test[.]dll

General

Target
trigger_test.dll
Size 101KB
Sample260826-nvtfjsvxet
SHA256 dfbc980f5b3e063523620f2758265796d1db885e78469689ca6367faae6b1c2d
MD5 9d0b0fe3433325ad426ec8f6bf0ffcce
SHA1 9299cfddd689fd01326643017761165ac3ee557d
SHA512 bc38056b5f43ff0ec310740ff044f5b1405b620a01b8d05e2ad08802b558abe6f743785713cc4ab444a22ea4d93b5e272498903ee26d21f4280fe8244ae35d38
SSDEEP 3072:H56QGtrMdsmTWZ2t5L8Yzs9N10cZIWxfr:IdtrOzK2t5AY09
TLSH
T12CA34A9776E500BBE1B78674C8670E45E3B6F82107619BEF03A4425A2F237E14D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
trigger_test.dll

File Explorer

trigger_test.dll

.dll 101KB

trigger_test.dll

IMPHASH daf6f5945d31f1732dbbd2de6ce3f6ab
SHA256 dfbc980f5b3e063523620f2758265796d1db885e78469689ca6367faae6b1c2d
MD5 9d0b0fe3433325ad426ec8f6bf0ffcce
SHA1 9299cfddd689fd01326643017761165ac3ee557d
SHA512 bc38056b5f43ff0ec310740ff044f5b1405b620a01b8d05e2ad08802b558abe6f743785713cc4ab444a22ea4d93b5e272498903ee26d21f4280fe8244ae35d38
SSDEEP 3072:H56QGtrMdsmTWZ2t5L8Yzs9N10cZIWxfr:IdtrOzK2t5AY09
TLSH
T12CA34A9776E500BBE1B78674C8670E45E3B6F82107619BEF03A4425A2F237E14D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

0

Major OS version

6

Entry point

4980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep CreateThread DisableThreadLibraryCalls FreeLibraryAndExitThread WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

trigger_test.dll

kernel32

generic