version[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.dll
Size 1.5MB
Sample260909-3bv8cssaqe
SHA256 2d882c176f371915ced6be588eaab284c0c0d2bfbdde400cfa9d9f91a93d5154
MD5 9e97eaa0e0a5cf61d1b1081508ed49a4
SHA1 424876707bad92f728bc12687a95f4385ed22f90
SHA512 16ee4fae794f7644d315ddd11b9996200db3ce40a3bb019248db7752c0e3a2d1c61f1f79df15b3d26086ec826b4b7eaa4f86a67ecb54f5c48858b1262510f477
SSDEEP 12288:37tMoqHwygJdyZKyRSAOjoWiQxl/Tev+DWj/ZwzsqUtZxz/YbYgAFQd/XSYgp6Xc:3hvawtr83REFkKWunIzgbYgp3YP5v
TLSH
T13C753AEB30D152FDC61AD57F8B02BD2F878FB23A4A27D9D36148A1168D1AD503E48E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 1.5MB

version.dll

IMPHASH 01d2c2bcb58c0952259c1b904f4b6d6a
SHA256 2d882c176f371915ced6be588eaab284c0c0d2bfbdde400cfa9d9f91a93d5154
MD5 9e97eaa0e0a5cf61d1b1081508ed49a4
SHA1 424876707bad92f728bc12687a95f4385ed22f90
SHA512 16ee4fae794f7644d315ddd11b9996200db3ce40a3bb019248db7752c0e3a2d1c61f1f79df15b3d26086ec826b4b7eaa4f86a67ecb54f5c48858b1262510f477
SSDEEP 12288:37tMoqHwygJdyZKyRSAOjoWiQxl/Tev+DWj/ZwzsqUtZxz/YbYgAFQd/XSYgp6Xc:3hvawtr83REFkKWunIzgbYgp3YP5v
TLSH
T13C753AEB30D152FDC61AD57F8B02BD2F878FB23A4A27D9D36148A1168D1AD503E48E35
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId SuspendThread ResumeThread CloseHandle CreateThread GetThreadContext GetCurrentProcessId SetThreadContext DisableThreadLibraryCalls GetCurrentThread GetSystemDirectoryW lstrcatW LoadLibraryW GetProcAddress ExitProcess FreeLibrary WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetLastError GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery VirtualProtectEx VirtualQueryEx SetLastError GetModuleHandleW LoadLibraryExA LoadLibraryExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Name

.text

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

version.dll

kernel32

ntdll

generic