SkyCode[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SkyCode.dll
Size 30.2MB
Sample260912-3sraqsbh63
SHA256 55b43b6c0d9dc83edd61c145e30d3144d1183fad907b34ca8fb1e1c10163da96
MD5 9579f7c982c7dd4a37065180e92cbe08
SHA1 3444b9383118fb7423a0903cce869553c94e7f5c
SHA512 5378f5b4f073f38c66238b5b0e2bd6f8215d5c3f2de4a819d1ee2cafb06d7369312b6366e9e1d2ff7af860f0e54378fd7e2f9b7c19a5f14c061cd0b69f767985
SSDEEP 393216:yqMdw/nOTwR/t6UNUZpjCS2e5yzIOtWnoKDfc2KWBK5MoUxw+AiaWj0z:6dieZpjCS2ehOMnJ7Cf9iaWoz
TLSH
T11C67CF2A729C4084F0B6C17DCACBDA47E7B238050B219BDB1690575E1F7FFD84A79A21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SkyCode.dll

File Explorer

SkyCode.dll

.dll 30.2MB

SkyCode.dll

IMPHASH 763dba08ce068495f031de54f4519267
SHA256 55b43b6c0d9dc83edd61c145e30d3144d1183fad907b34ca8fb1e1c10163da96
MD5 9579f7c982c7dd4a37065180e92cbe08
SHA1 3444b9383118fb7423a0903cce869553c94e7f5c
SHA512 5378f5b4f073f38c66238b5b0e2bd6f8215d5c3f2de4a819d1ee2cafb06d7369312b6366e9e1d2ff7af860f0e54378fd7e2f9b7c19a5f14c061cd0b69f767985
SSDEEP 393216:yqMdw/nOTwR/t6UNUZpjCS2e5yzIOtWnoKDfc2KWBK5MoUxw+AiaWj0z:6dieZpjCS2ehOMnJ7Cf9iaWoz
TLSH
T11C67CF2A729C4084F0B6C17DCACBDA47E7B238050B219BDB1690575E1F7FFD84A79A21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11023316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

dbghelp

MiniDumpWriteDump StackWalk64 SymSetOptions SymGetOptions SymCleanup SymFunctionTableAccess64 SymFromAddr SymUnloadModule64 SymLoadModuleEx SymInitialize SymGetLineFromAddr64 SymGetModuleBase64

winmm

waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInOpen waveInClose waveInPrepareHeader

d3d11

D3D11On12CreateDevice

d2d1

ord1

ws2_32

inet_ntoa getaddrinfo

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoDecrementMTAUsage CoTaskMemFree CoInitialize CoInitializeEx CoUninitialize PropVariantClear CoIncrementMTAUsage

mfplat

MFCreateAttributes MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromURL

propsys

PropVariantToInt64 PropVariantToStringAlloc PropVariantToUInt64

shlwapi

UrlCreateFromPathW

shell32

SHGetPropertyStoreFromParsingName SHOpenFolderAndSelectItems SHParseDisplayName ShellExecuteW

kernel32

IsValidCodePage HeapQueryInformation HeapSize GetTimeZoneInformation SetConsoleCtrlHandler ReadConsoleW GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread ExitProcess LoadLibraryExW CreateThreadpoolTimer GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WaitForThreadpoolWorkCallbacks GetNativeSystemInfo GetExitCodeThread GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte CloseHandle WaitForSingleObject CreateEventA GetModuleHandleA GetProcAddress LoadLibraryA VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FlushFileBuffers WriteFile SetUnhandledExceptionFilter AddVectoredExceptionHandler GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId GetLocalTime GetTickCount64 VirtualQuery DisableThreadLibraryCalls GetModuleFileNameW GetLastError GetModuleFileNameA CreateToolhelp32Snapshot Module32First Module32Next GetStdHandle CreateFileA ReadFile SetFilePointer FlushInstructionCache VirtualProtect LoadLibraryExA AllocConsole FreeConsole GetConsoleMode SetConsoleMode SetEndOfFile K32GetModuleFileNameExA GetACP DeleteFileA FindClose FindFirstFileA FindNextFileA Sleep GetSystemInfo VirtualAlloc VirtualFree CompareFileTime GetFileTime ExpandEnvironmentStringsA SetNamedPipeHandleState GetFileInformationByHandle GetFileSizeEx SetFilePointerEx SetEvent ResetEvent ReleaseSemaphore CreateThread SetThreadPriority CreateProcessW GetWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateSemaphoreA RtlCaptureContext GetFileAttributesA GetDynamicTimeZoneInformation WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree OpenThread SuspendThread ResumeThread CloseThreadpoolTimer SetThreadContext GetModuleHandleW Thread32First Thread32Next SetLastError GetCurrentThread GetThreadTimes SwitchToThread WaitForSingleObjectEx TryAcquireSRWLockShared AcquireSRWLockShared ReleaseSRWLockShared CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx LocalFree IsProcessorFeaturePresent RtlCaptureStackBackTrace GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns FormatMessageA InitOnceComplete TlsFree GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW InitOnceBeginInitialize SleepConditionVariableSRW WakeAllConditionVariable RtlUnwind FormatMessageW SetThreadpoolTimer WaitForThreadpoolTimerCallbacks FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap K32GetModuleInformation OutputDebugStringW SetConsoleTitleA GetThreadContext TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetStringTypeW GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable

user32

SetCursorPos ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetWindowLongPtrA GetCapture ClientToScreen GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetDpiForWindow ScreenToClient LoadCursorA MonitorFromWindow SetProcessDPIAware GetWindowTextA SetCursor GetWindowRect EnumWindows GetAsyncKeyState GetKeyState MessageBoxA GetKeyboardState ToAscii MapVirtualKeyA DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow SetCapture

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

oleaut32

SysFreeString SysAllocString GetErrorInfo SysStringLen SetErrorInfo

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

wininet

InternetCrackUrlA HttpQueryInfoA InternetReadFile HttpOpenRequestA InternetCloseHandle InternetOpenA HttpSendRequestA InternetCheckConnectionA InternetConnectA InternetOpenUrlA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14.3MB

Virtual Size

14.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

704KB

Virtual Size

703KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SkyCode.dll

version

dbghelp

winmm

d3d11

d2d1

ws2_32

ole32

mfplat

mfreadwrite

propsys

shlwapi

shell32

kernel32

user32

gdi32

oleaut32

advapi32

imm32

d3dcompiler_47

dwmapi

bcrypt

wininet

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic