skeetcrack[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
skeetcrack.dll
Size 4.5MB
Sample260930-tre2msce39
SHA256 5eac27e2a11ddf6ac75c3171f864eaaa356e557ee42ea142dfc91cfbdc30ae95
MD5 dc66cd67e9b1754e6eb7737a20e25891
SHA1 8e9792592af4741883348b67c3b11ba74d1a5127
SHA512 1facf132ec2a2623994fb0de93a4a9271204d233120e4e958306f590f2fafe11ee59d295a2cb409b34ccdc03f6f353673d1ef186920f872c20b068bf9021fbbd
SSDEEP 49152:5WkyCqoj4k+qSe5YWScn9WH3nXH3nXH3nXH3n19zNXSt6nDFb6PE9XwXX9uBXrFF:5WMSEQ1St6DFSPX9uBXrD83j/K
TLSH
T1CB26BF07F74251EED42AC47882975327A231B44A07329ADF53C45B396EE37E02F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
skeetcrack.dll

File Explorer

skeetcrack.dll

.dll 4.5MB

skeetcrack.dll

IMPHASH 7d3b90307948ee35dd031ad147e1b442
SHA256 5eac27e2a11ddf6ac75c3171f864eaaa356e557ee42ea142dfc91cfbdc30ae95
MD5 dc66cd67e9b1754e6eb7737a20e25891
SHA1 8e9792592af4741883348b67c3b11ba74d1a5127
SHA512 1facf132ec2a2623994fb0de93a4a9271204d233120e4e958306f590f2fafe11ee59d295a2cb409b34ccdc03f6f353673d1ef186920f872c20b068bf9021fbbd
SSDEEP 49152:5WkyCqoj4k+qSe5YWScn9WH3nXH3nXH3nXH3n19zNXSt6nDFb6PE9XwXX9uBXrFF:5WMSEQ1St6DFSPX9uBXrD83j/K
TLSH
T1CB26BF07F74251EED42AC47882975327A231B44A07329ADF53C45B396EE37E02F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1138944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\skeet\skeet\..\bin\Release\payload\skeet.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CloseHandle CompareFileTime CompareStringOrdinal CompareStringW CreateDirectoryW CreateFileA CreateFileMappingA CreateFileW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MoveFileExW MultiByteToWideChar OpenFileMappingW OpenProcess ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal

user32

CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard GetAsyncKeyState GetCapture GetClipboardData GetCursorInfo GetCursorPos GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW MessageBoxA MessageBoxW OpenClipboard RegisterClassExA ReleaseCapture ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos ShowCursor UnregisterClassA

shell32

SHGetKnownFolderPath

gdi32

CreateCompatibleDC CreateFontA DeleteDC DeleteObject GetFontData SelectObject

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

skeetcrack.dll

kernel32

ole32

user32

shell32

gdi32

bcrypt

d3d11

generic