freemc[.]dll | Triage™

General

Target
freemc.dll
Size 664KB
Sample260920-152acstwft
SHA256 83de389d3042ceefad61329867e2ca7ac2c5bbc4f3d719318e467caac4cbb966
MD5 9f988797006d4a83b5d113872d969d57
SHA1 745062c4dadfd6a11b303d07430dd1f2d8098302
SHA512 0fd4df68fce42c41392e352e5532438b67f0db764349ff64cff33e794cc02b062189ff937c468f874dbdc2b73ace2837b0ef4b58ae6bf8fd794f4f6f4709e641
SSDEEP 12288:M4UyC4wn3ROa4nDmTdo6YAyjx1//9tildbqn+Ko1y:MJyC4W3IDsu6YAyjmqn+Kk
TLSH
T143E4BE55F2A801F9E077903AC497A627E7713824172096DB23E406ADBFB73E44B7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
freemc.dll

File Explorer

freemc.dll

.dll 664KB

freemc.dll

IMPHASH b2d7d33a885cad7e0a2217a0480d5ff9
SHA256 83de389d3042ceefad61329867e2ca7ac2c5bbc4f3d719318e467caac4cbb966
MD5 9f988797006d4a83b5d113872d969d57
SHA1 745062c4dadfd6a11b303d07430dd1f2d8098302
SHA512 0fd4df68fce42c41392e352e5532438b67f0db764349ff64cff33e794cc02b062189ff937c468f874dbdc2b73ace2837b0ef4b58ae6bf8fd794f4f6f4709e641
SSDEEP 12288:M4UyC4wn3ROa4nDmTdo6YAyjx1//9tildbqn+Ko1y:MJyC4W3IDsu6YAyjmqn+Kk
TLSH
T143E4BE55F2A801F9E077903AC497A627E7713824172096DB23E406ADBFB73E44B7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

330256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

user32

GetCursorPos ScreenToClient SendInput GetClientRect GetMessageW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetCursorInfo GetDesktopWindow SetClassLongPtrW ClipCursor GetClipCursor ShowCursor GetWindowRect CallNextHookEx GetDC WindowFromDC RegisterRawInputDevices GetRawInputData LoadCursorW GetWindowThreadProcessId GetClassNameW EnumWindows FindWindowW SetWindowLongPtrW GetWindowLongPtrW SetCursor GetWindowTextW GetForegroundWindow KillTimer SetTimer GetAsyncKeyState IsWindowVisible IsWindow CreateWindowExW RegisterClassW CallWindowProcW DefWindowProcW GetMessageExtraInfo DispatchMessageW TranslateMessage

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetFileType GetStdHandle LCMapStringW LoadLibraryExW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer CloseHandle GetLastError AddVectoredExceptionHandler CreateMutexW Sleep GetTickCount64 DisableThreadLibraryCalls FreeLibraryAndExitThread GetModuleHandleW GetModuleHandleExW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStringTypeW QueryPerformanceFrequency GetLocalTime GetModuleFileNameW MoveFileExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryA HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect Thread32First Thread32Next GetSystemInfo VirtualAlloc VirtualFree VirtualQuery SetStdHandle CreateFileW HeapSize SetEndOfFile RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive SetLastError FlsAlloc FlsGetValue FlsSetValue GetProcessHeap WriteConsoleW QueryPerformanceCounter FlsFree InterlockedFlushSList

opengl32

glTexParameteri glTexImage2D glTexEnvi glTexCoordPointer glShadeModel glScissor glPushMatrix glPushAttrib glPopMatrix glPopAttrib glPolygonMode glPixelStorei glOrtho glMatrixMode glVertexPointer glGetTexEnviv glGetIntegerv glGenTextures glEnableClientState glEnable glDrawElements glDisableClientState glDisable glDeleteTextures glColorPointer glBlendFunc glBindTexture wglMakeCurrent wglGetCurrentDC wglGetCurrentContext glLoadIdentity glViewport

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

freemc.dll

user32

kernel32

opengl32

imm32

generic