unhooked_menu[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
unhooked_menu.dll
Size 400KB
Sample260916-rfhbhsbc58
SHA256 6fc6299093a3be54b985e7362e6d92b83cb5f9dc5be9a655d8930bb64b770d36
MD5 c88da2b5d02f693667055926eda0cb70
SHA1 16e5194f662d04ba2939a962d22f5682d8179772
SHA512 ffa260ba1e09a7ed58f90c26f059d31d2f983cdeb4fed5467a7d5cd1c8acb82ec97ec13105ddec17cd831038f31cdb4f42900d680faf19addb0965faa1fa3340
SSDEEP 6144:6OOAvH9xsm3zzkz78wdQYyFm4KchLF2DuHNLp3ZnDInFwgiNPUionSkhyW:NOA/gNdQ3m4K+Z0utViziCjnSkkW
TLSH
T1CC949E96F1F458E8D07FE13891AAA61FEA39341C172049CF73E805582BF37E466B6712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unhooked_menu.dll

File Explorer

unhooked_menu.dll

.dll 400KB

unhooked_menu.dll

IMPHASH cf2306be98018e2668c3a65f720665e0
SHA256 6fc6299093a3be54b985e7362e6d92b83cb5f9dc5be9a655d8930bb64b770d36
MD5 c88da2b5d02f693667055926eda0cb70
SHA1 16e5194f662d04ba2939a962d22f5682d8179772
SHA512 ffa260ba1e09a7ed58f90c26f059d31d2f983cdeb4fed5467a7d5cd1c8acb82ec97ec13105ddec17cd831038f31cdb4f42900d680faf19addb0965faa1fa3340
SSDEEP 6144:6OOAvH9xsm3zzkz78wdQYyFm4KchLF2DuHNLp3ZnDInFwgiNPUionSkhyW:NOA/gNdQ3m4K+Z0utViziCjnSkkW
TLSH
T1CC949E96F1F458E8D07FE13891AAA61FEA39341C172049CF73E805582BF37E466B6712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

314148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte CloseHandle GetLastError HeapCreate HeapAlloc HeapReAlloc HeapFree Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread GlobalUnlock ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateToolhelp32Snapshot Thread32First Thread32Next GetSystemInfo VirtualAlloc VirtualFree VirtualQuery InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalLock GlobalAlloc OutputDebugStringA GetModuleHandleW DisableThreadLibraryCalls CreateThread IsDebuggerPresent SuspendThread

user32

GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient GetClipboardData IsWindowUnicode ReleaseCapture SetCapture GetCapture LoadCursorA GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetForegroundWindow DefWindowProcW CallWindowProcW UnregisterClassW SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrW GetAsyncKeyState DestroyWindow CreateWindowExW RegisterClassExW

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

vcruntime140

__std_type_info_destroy_list __C_specific_handler __std_terminate memcmp memset memmove memcpy memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen strcmp

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsscanf fflush fread fseek ftell fwrite __acrt_iob_func _wfopen __stdio_common_vfprintf __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-math-l1-1-0

sinf ceilf cosf fmodf sqrtf acosf

api-ms-win-crt-runtime-l1-1-0

_cexit _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table