Aether[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Aether.dll
Size 1.0MB
Sample260916-3f27gagn91
SHA256 068efa8d3430934d60c0ec5b88cd1b7d41b781ad59f6f088b69e04362cff7333
MD5 4c5248b425eb8689a9eb19f5ab4685a7
SHA1 363f92f596d460b3bc89ea81caa078b656b792cc
SHA512 54da7943d91ec5fd9f7cff2f3ad50b38b3d9a78ce393755d7c870c27ab60866ca8b001b59036df59a7e2131135679e302431ea56c734f362d3205a8f90dc766c
SSDEEP 24576:CS7XB/n24ttBwj+wU2p7W5QN+wWIyMxjD5eWi8nF/8:Cd4twj+wUsq517ItJy8nF
TLSH
T14F354928A7E899A8F0B7C674DAA91512F93638C50735D9EF2394824D4F367F40939F32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aether.dll

File Explorer

Aether.dll

.dll 1.0MB

Aether.dll

IMPHASH 9cdadb88e64e2983b4aeedd5246cebe1
SHA256 068efa8d3430934d60c0ec5b88cd1b7d41b781ad59f6f088b69e04362cff7333
MD5 4c5248b425eb8689a9eb19f5ab4685a7
SHA1 363f92f596d460b3bc89ea81caa078b656b792cc
SHA512 54da7943d91ec5fd9f7cff2f3ad50b38b3d9a78ce393755d7c870c27ab60866ca8b001b59036df59a7e2131135679e302431ea56c734f362d3205a8f90dc766c
SSDEEP 24576:CS7XB/n24ttBwj+wU2p7W5QN+wWIyMxjD5eWi8nF/8:Cd4twj+wUsq517ItJy8nF
TLSH
T14F354928A7E899A8F0B7C674DAA91512F93638C50735D9EF2394824D4F367F40939F32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

681232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\jay28\Downloads\PixelGunCheatInternal-master\PixelGunCheatInternal-master\x64\Release\Aether.pdb

kernel32

GetStdHandle FreeLibraryAndExitThread DisableThreadLibraryCalls FreeConsole AllocConsole SetConsoleTitleW QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA MultiByteToWideChar GetLocaleInfoA IsDBCSLeadByte OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetLastError HeapCreate HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache CreateToolhelp32Snapshot Thread32First Thread32Next GetSystemInfo VirtualAlloc VirtualFree VirtualQuery SetConsoleTextAttribute FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW WideCharToMultiByte GetProcAddress CreateThread GetFileAttributesExW CreateFile2 AreFileApisANSI CloseHandle GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW Sleep GetModuleHandleA GetModuleFileNameW VirtualProtect LocalFree CreateDirectoryW

user32

TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture GetKeyboardLayout ReleaseCapture SetClipboardData CloseClipboard IsWindowUnicode SetCapture SetCursorPos GetForegroundWindow OpenClipboard CallWindowProcW MapVirtualKeyW EmptyClipboard ScreenToClient GetAsyncKeyState ClientToScreen ClipCursor GetClientRect PostQuitMessage ShowCursor GetCursorPos DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW GetActiveWindow GetWindowRect LoadCursorA SetCursor GetDesktopWindow SetWindowLongPtrW GetClipboardData

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Mtx_lock _Mtx_unlock ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Syserror_map@std@@YAPEBDH@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter _Xtime_get_ticks ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __std_type_info_destroy_list _CxxThrowException __C_specific_handler __current_exception __std_exception_destroy __std_exception_copy __std_terminate _purecall strrchr memcpy memset memchr memcmp memmove strchr

api-ms-win-crt-stdio-l1-1-0

_wfopen fseek ftell __stdio_common_vfprintf __stdio_common_vsprintf fclose fgetc fwrite fopen_s fgetpos setvbuf ungetc fsetpos fread _fseeki64 _get_stream_buffer_pointers fputc __stdio_common_vsscanf __acrt_iob_func freopen_s fflush

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh calloc

api-ms-win-crt-convert-l1-1-0

strtol atof strtof

api-ms-win-crt-string-l1-1-0

strcmp tolower wcslen strncpy strncmp strlen

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file

api-ms-win-crt-runtime-l1-1-0

_cexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initterm _initialize_narrow_environment _errno _configure_narrow_argv _initterm_e _beginthreadex _seh_filter_dll abort terminate _crt_atexit

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

sinf cosf ceilf acosf pow sqrtf sqrt asinf atan2f logf log fmodf powf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

shell32

ShellExecuteW