Downloader[.]dll | Triage™

Resubmissions

22/09/2026, 11:03

260922-m5xqaavajb

22/09/2026, 11:00

260922-m4e4vacf763

Sharing

Copy URL Twitter E-mail

General

Target
Downloader.dll
Size 199KB
Sample260922-m4e4vacf76
SHA256 a08c6fe5feddbb534659baf002c244c173e03aa947bc30dba1f698ff841b21a9
MD5 74a68460ddc67986a5045a2fb1aae374
SHA1 bb2c3d04ea96fe59f997c310b345189d308a864b
SHA512 a2a43cb924b64e798561f14a9c0fbae8bf777af42496f290e61faa60a56513d0d78fd54175b978e54ecd2560a36c898739dd6b3679783f4d0e5932d70d2de5ed
SSDEEP 6144:Ej4UFGJ+RglWkyWw7KU9evkCEnoP143DyZgQ:24M5kfOKbEl3DySQ
TLSH
T115148C16E78060BED6FB3570113B6F3568BE9B352F908DC313648952A9307C4DA3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Downloader.dll

.dll 199KB

Downloader.dll

IMPHASH dd95f680cd2327ee8ee0dbaabe60677f
SHA256 a08c6fe5feddbb534659baf002c244c173e03aa947bc30dba1f698ff841b21a9
MD5 74a68460ddc67986a5045a2fb1aae374
SHA1 bb2c3d04ea96fe59f997c310b345189d308a864b
SHA512 a2a43cb924b64e798561f14a9c0fbae8bf777af42496f290e61faa60a56513d0d78fd54175b978e54ecd2560a36c898739dd6b3679783f4d0e5932d70d2de5ed
SSDEEP 6144:Ej4UFGJ+RglWkyWw7KU9evkCEnoP143DyZgQ:24M5kfOKbEl3DySQ
TLSH
T115148C16E78060BED6FB3570113B6F3568BE9B352F908DC313648952A9307C4DA3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Digest

ae:3a:e4:d4:bd:41:92:ca:f1:49:85:75:43:65:ec:de:b1:58:29:ba:0e:38:63:98:87:8c:75:56:e1:06:d2:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 26, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2025 - May 6, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

173712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Downloader.pdb

msvcrt

iswspace _wcsnicmp _wcsicmp bsearch _vsnwprintf memcmp memmove _except_handler4_common _onexit __dllonexit _unlock _lock _initterm malloc free _amsg_exit _XcptFilter sprintf_s _wcstoui64 wcschr swprintf_s strncmp _purecall _wtoi64 wcscat_s memcpy_s memcpy memset

advapi32

CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptDeriveKey CryptCreateHash CryptEncrypt CryptAcquireContextW EnableTraceEx2 RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW QueryTraceW EventUnregister ControlTraceW RegOpenKeyExW RegSetValueExW RegSetKeySecurity EventSetInformation RegCreateKeyExW EventRegister EventWriteTransfer RegCloseKey StartTraceW CryptDestroyKey

ntdll

DbgPrintEx NtYieldExecution RtlRaiseStatus NtOpenFile NtWaitForSingleObject NtQueryInformationFile RtlExpandEnvironmentStrings NtClose RtlReAllocateHeap NtReadFile NtSetInformationFile RtlInitUnicodeString RtlDosPathNameToNtPathName_U_WithStatus NtWriteFile RtlFreeHeap RtlAllocateHeap RtlNtStatusToDosError RtlGetVersion

kernel32

GetModuleFileNameA GetFileSizeEx CreateSemaphoreExW HeapFree SetLastError ReleaseSemaphore WriteFile GetModuleHandleExW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle HeapAlloc GetProcAddress CreateMutexExW GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent CreateDirectoryW ReadFile InitOnceBeginInitialize FindFirstFileW CompareStringW FindNextFileW GetCurrentProcess GetSystemDefaultUILanguage GetModuleFileNameW GetTempPathW CreateMutexW FindClose LocalAlloc GetFileAttributesW InitOnceComplete DeleteFileW GlobalFree GetSystemInfo LocalFree FreeLibrary CopyFileW WideCharToMultiByte MoveFileW LoadLibraryExW Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetTickCount GetFullPathNameW GetCurrentProcessId GetSystemTimeAsFileTime

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpOpenRequest WinHttpSetOption WinHttpGetProxyForUrl WinHttpQueryHeaders WinHttpCrackUrl WinHttpSendRequest WinHttpReadData

rpcrt4

UuidCreate

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW PathFileExistsW

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Downloader.dll

msvcrt

advapi32

ntdll

kernel32

winhttp

rpcrt4

ole32

shlwapi

bcrypt

generic