sorryhack[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sorryhack.dll
Size 2.1MB
Sample260916-ttzttsshjc
SHA256 7616546513e2166e162ac5576ee2e36568d783a7519c58c910b00d8c040e96df
MD5 37a7a6abb71b5f11cb65d0582a749e10
SHA1 7816aea2484c327328f1efd7a09bc802fd5be85a
SHA512 3fc2ff4df463d744d8668f2c4a913803cb816817bfc9cac13c4baad266f22d57010d140557f144010cbefa2487fa5bc339b4a5009e6dd8a027fc1e11b2cc7800
SSDEEP 24576:q3S3HO2Kybooaq9tHzSUSjNYBY1vbma2IEZilRRJjlhsUcRenA8ZwfU0d7WJv0CE:qi3GytY1aauZmRQUcoA8Zw6JLToce5Q
TLSH
T1A6A57F31E522CC1CD8A289725CEA9D7DD3ACBA103B5600C375C89F9A5D4F4D1AAF24ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sorryhack.dll

File Explorer

sorryhack.dll

.dll 2.1MB

sorryhack.dll

IMPHASH 719d2747e15dcd974102dca5b5315441
SHA256 7616546513e2166e162ac5576ee2e36568d783a7519c58c910b00d8c040e96df
MD5 37a7a6abb71b5f11cb65d0582a749e10
SHA1 7816aea2484c327328f1efd7a09bc802fd5be85a
SHA512 3fc2ff4df463d744d8668f2c4a913803cb816817bfc9cac13c4baad266f22d57010d140557f144010cbefa2487fa5bc339b4a5009e6dd8a027fc1e11b2cc7800
SSDEEP 24576:q3S3HO2Kybooaq9tHzSUSjNYBY1vbma2IEZilRRJjlhsUcRenA8ZwfU0d7WJv0CE:qi3GytY1aauZmRQUcoA8Zw6JLToce5Q
TLSH
T1A6A57F31E522CC1CD8A289725CEA9D7DD3ACBA103B5600C375C89F9A5D4F4D1AAF24ED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo\addons\sorryhack.pdb

comdlg32

GetOpenFileNameA

tier0

?DevMsg@@YAXPBDZZ Msg ?ConMsg@@YAXPBDZZ Warning DevMsg GetThreadedLoadLibraryFunc Error _AssertValidReadPtr _AssertValidWritePtr _AssertValidStringPtr g_pMemAlloc ?ConColorMsg@@YAXABVColor@@PBDZZ Plat_IsInDebugSession CommandLine CreateSimpleThread ReleaseThreadHandle GetCPUInformation

msvcp140

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Random_device@std@@YAIXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ?good@ios_base@std@@QBE_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??Bid@locale@std@@QAEIXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ??0_Lockit@std@@QAE@H@Z ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ _Mbrtowc ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Throw_C_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ??1_Lockit@std@@QAE@XZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ

kernel32

CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW DeviceIoControl GetLastError AreFileApisANSI GetTempPathW SetFileTime SetFilePointerEx SetFileInformationByHandle SetFileAttributesW SetEndOfFile GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindClose CreateFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW FormatMessageA LocalFree InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime QueryPerformanceCounter TerminateProcess GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA WaitForSingleObject FreeLibrary WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Thread32Next Thread32First CreateToolhelp32Snapshot GetModuleHandleW FlushInstructionCache SetThreadContext GetThreadContext ResumeThread SuspendThread OpenThread GetCurrentThreadId GetCurrentProcessId HeapFree HeapReAlloc HeapAlloc HeapDestroy HeapCreate CloseHandle VirtualQuery VirtualFree VirtualAlloc Sleep GetCurrentProcess VirtualProtect WriteProcessMemory GetModuleHandleA GetProcAddress

vcruntime140

__current_exception_context __std_type_info_destroy_list _except_handler4_common __current_exception memcpy memmove memset __std_exception_copy __std_exception_destroy _CxxThrowException __CxxFrameHandler3 _purecall __RTDynamicCast __std_terminate memchr strchr strstr

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv terminate _execute_onexit_table _beginthreadex _wassert _initialize_narrow_environment _initialize_onexit_table _crt_atexit _invalid_parameter_noinfo_noreturn exit _crt_at_quick_exit _errno _cexit strerror _register_onexit_function _initterm _initterm_e

api-ms-win-crt-string-l1-1-0

_strupr wcslen isspace strncpy strncat wcsncpy tolower strcmp strpbrk _stricmp _strlwr isdigit strlen strncmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free calloc

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-convert-l1-1-0

atoi strtol strtod strtoul atof _wtoi _wtof _strtoi64 _strtoui64

api-ms-win-crt-stdio-l1-1-0

_getcwd __stdio_common_vswprintf _write fgetpos _close _read fgetc fputc __stdio_common_vsscanf _get_stream_buffer_pointers __stdio_common_vfprintf __acrt_iob_func __stdio_common_vsprintf fclose fflush ungetc setvbuf fwrite _fseeki64 fsetpos fread

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _chdir _lock_file

api-ms-win-crt-math-l1-1-0

_except1 _CIasin _CIfmod ceil fabs atan2 _CIpow floor _CIacos

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

vstdlib

KeyValuesSystem

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

580KB

Virtual Size

646KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=6, id=253, version=30818,

count=24, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=11, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=11, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,

count=6, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=3, id=110, productName=VS2005 build 50727, version=50727,

count=10, id=261, version=24245,

count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=5, id=203, version=65501,

count=268, id=1, productName=Unmarked objects,

count=37, id=261, version=31328,

count=1, id=256, version=31328,

count=1, id=255, version=31328,

count=1, id=258, version=31328,