TheRawExt[.]dll | Triage™

General

Target
TheRawExt.dll
Size 480KB
Sample260916-pqb65szgrf
SHA256 52583b5108c6367d11b071f0ab9e1c89289da54e80f01535fd1ee4c5e9a02b2e
MD5 a657f6ca7ab1f4bab8e05da0c42f27a6
SHA1 59391c7c25dc4b29ae5e9a69e4684216a9000fd4
SHA512 3c97a1ab0753b82f3801737e774fab15f39ad43f5194708e443990dbd6e92a8fdbb6fb5f6b17098f8eecc2d2ba97faaaa469dd841670d561c7d95cd520fc00ec
SSDEEP 12288:RTEm/wOvdO3MhXUBHETBXWTG3ZSakZPUChXn7m:RZvdOuX4RCpitUChXn7m
TLSH
T14DA4AD1F3C694527D0AC007D842CBB95CCBFF8215BE598DB363488EA49225935FECA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TheRawExt.dll

File Explorer

TheRawExt.dll

.dll 480KB

TheRawExt.dll

IMPHASH f1092c819ddb2664fb7c81f7571cefbf
SHA256 52583b5108c6367d11b071f0ab9e1c89289da54e80f01535fd1ee4c5e9a02b2e
MD5 a657f6ca7ab1f4bab8e05da0c42f27a6
SHA1 59391c7c25dc4b29ae5e9a69e4684216a9000fd4
SHA512 3c97a1ab0753b82f3801737e774fab15f39ad43f5194708e443990dbd6e92a8fdbb6fb5f6b17098f8eecc2d2ba97faaaa469dd841670d561c7d95cd520fc00ec
SSDEEP 12288:RTEm/wOvdO3MhXUBHETBXWTG3ZSakZPUChXn7m:RZvdOuX4RCpitUChXn7m
TLSH
T14DA4AD1F3C694527D0AC007D842CBB95CCBFF8215BE598DB363488EA49225935FECA5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

74809

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateFileW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetThreadContext GetTickCount HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OpenThread QueryPerformanceCounter RaiseException ResumeThread RtlUnwind SetFilePointerEx SetLastError SetStdHandle SetThreadContext SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

user32

FindWindowA GetShellWindow MessageBoxA MessageBoxTimeoutA

ws2_32

WSASend closesocket inet_addr inet_ntoa

Sharing