red[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
red.dll
Size 425KB
Sample260925-pmlleawbrd
SHA256 b7be1fcee894741f7a12d6b4d018d2dbc867ae0d3099332e79038fb291bb9250
MD5 2e0659d85fa9fb292b6a109af55c87d4
SHA1 b0d91e1770e3768a692b325585a977fa74a6be35
SHA512 c1a2d8934f77f9b9e3683a4bd4d999321135e41c95cbaf2af07232f2e609b57111e4a23fba3550b9074093169357e3a4db490eb38bdf657f153d01b6ca214d91
SSDEEP 6144:9Z1lpmUgTJ58TO8h94Fezpz0EX2g4SpUmDkLzt1J/JGYwqUFqoIP4IH/eeG:9ZtmU0GO8h9tbUOc7/h
TLSH
T1E9947469B98B45E2F606703549739E8FC13E980A2727A3E7B04B56452CED7D070BD38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
red.dll

File Explorer

red.dll

.dll 425KB

red.dll

IMPHASH 378ffc516fbbd6fd8422fcf76b88d767
SHA256 b7be1fcee894741f7a12d6b4d018d2dbc867ae0d3099332e79038fb291bb9250
MD5 2e0659d85fa9fb292b6a109af55c87d4
SHA1 b0d91e1770e3768a692b325585a977fa74a6be35
SHA512 c1a2d8934f77f9b9e3683a4bd4d999321135e41c95cbaf2af07232f2e609b57111e4a23fba3550b9074093169357e3a4db490eb38bdf657f153d01b6ca214d91
SSDEEP 6144:9Z1lpmUgTJ58TO8h94Fezpz0EX2g4SpUmDkLzt1J/JGYwqUFqoIP4IH/eeG:9ZtmU0GO8h9tbUOc7/h
TLSH
T1E9947469B98B45E2F606703549739E8FC13E980A2727A3E7B04B56452CED7D070BD38E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4111

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\MYSTERY\Downloads\UnityChams-main\out\build\x64-Release\ShaderDumper.pdb

opengl32

wglGetProcAddress wglGetCurrentDC glGetString glTexParameteri glDepthRange glDisable glTexImage2D glBegin glDrawElements glEnable glEnd glGetIntegerv glPolygonMode glVertex2f glVertex3f glBindTexture glGenTextures

kernel32

InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext Thread32First CreateToolhelp32Snapshot VirtualQuery VirtualFree VirtualAlloc GetSystemInfo Sleep CreateThread FreeLibraryAndExitThread AllocConsole FreeConsole CloseHandle GetLastError HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect GetModuleHandleW GetProcAddress Thread32Next

user32

GetAsyncKeyState

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__current_exception __current_exception_context __std_type_info_destroy_list __std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler memcmp memset memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _register_onexit_function _invalid_parameter_noinfo_noreturn _crt_at_quick_exit _initterm_e _initterm _crt_atexit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll terminate _cexit

api-ms-win-crt-stdio-l1-1-0

freopen_s __acrt_iob_func fclose __stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh

Name

.text

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

red.dll

opengl32

kernel32

user32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic