EliteSombra! V2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
EliteSombra! V2.dll
Size 33.3MB
Sample260904-2rx68aywcw
SHA256 17fed157fb6e8d53d5abd7611188f4e1ae27c34137e396d24a8d3544b6f6337f
MD5 a8a0e2e2d412c2e66a857ee103b9e645
SHA1 38f8fdb2d88bfa61f085cc450a18c65bc160f5be
SHA512 baf58388b2e4759499d457fa6a7b46407fc8468db934603241abfbb35b70a71fd4afd7a5e0e353baaf6d7183fa993685e71b61e5d7a4b5ab684a5fb6661e366a
SSDEEP 786432:ztWaqUL4N4pWjnw54PkkYnxSuiRJ4UvExYeqCLLmE0/ozp:zUULTpWjnhkrxURWUvExYy9R
TLSH
T1867723DA29D562D4D7C30660738E03DA61C1987D86FE5C383EC73C029A21DEB958ADB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EliteSombra! V2.dll

File Explorer

EliteSombra! V2.dll

.dll 33.3MB

EliteSombra! V2.dll

IMPHASH f5f70ad5c1624e2d4e8cab113e764292
SHA256 17fed157fb6e8d53d5abd7611188f4e1ae27c34137e396d24a8d3544b6f6337f
MD5 a8a0e2e2d412c2e66a857ee103b9e645
SHA1 38f8fdb2d88bfa61f085cc450a18c65bc160f5be
SHA512 baf58388b2e4759499d457fa6a7b46407fc8468db934603241abfbb35b70a71fd4afd7a5e0e353baaf6d7183fa993685e71b61e5d7a4b5ab684a5fb6661e366a
SSDEEP 786432:ztWaqUL4N4pWjnw54PkkYnxSuiRJ4UvExYeqCLLmE0/ozp:zUULTpWjnhkrxURWUvExYy9R
TLSH
T1867723DA29D562D4D7C30660738E03DA61C1987D86FE5C383EC73C029A21DEB958ADB7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29301533

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shlwapi

PathRemoveFileSpecA

ws2_32

htons

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

crypt32

CertFindCertificateInStore

wldap32

ord32

normaliz

IdnToUnicode

kernel32

GetFileAttributesExW GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

ReleaseCapture

gdi32

CreateSolidBrush

advapi32

CryptCreateHash

shell32

ShellExecuteA

ole32

CoSetProxyBlanket

oleaut32

VariantClear

msvcp140

_Mtx_init_in_situ

imm32

ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

d2d1

ord1

dwrite

DWriteCreateFactory

urlmon

URLDownloadToFileA

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_errno

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-math-l1-1-0

log2

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func

api-ms-win-crt-filesystem-l1-1-0

_unlink

Name

.text

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.g0M

Size

Virtual Size

19.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.96G

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.}?~

Size

33.3MB

Virtual Size

33.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

EliteSombra! V2.dll

shlwapi

ws2_32

d3d11

d3dcompiler_47

crypt32

wldap32

normaliz

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

imm32

dwmapi

d2d1

dwrite

urlmon

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic