version[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
version.dll
Size 10.5MB
Sample260930-v6n4jaeb83
SHA256 0ce7a4e530c7f83f172a2c44aed45eedb3bdcf06b83760f143a0fba6885fa929
MD5 3ee01c075c850e116bcb7d70a2d4f964
SHA1 afa3cda2fb91bd0dd34317961402458f16be8d6b
SHA512 bf84fe5328555f8865eeb638b5267ea393dea0900dc3b0c9d60ed75fde5a9f4bd112127ea321661d1b51bb87e7b37fe45d65f58454779cebe07fb732a0cd6ef6
SSDEEP 98304:LMjCcSICqn6GEJGzSqoXCC98xPbXhDOJuZKl:QV9Cqn52pXC683OJWU
TLSH
T150B68D2C53A905F6D82AE679C692C633DAF0BD96532AC14F091DF5442F77E208B3F225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version.dll

File Explorer

version.dll

.dll 10.5MB

version.dll

IMPHASH 1c7214fecd5107d8c5f375b46fc3c7fa
SHA256 0ce7a4e530c7f83f172a2c44aed45eedb3bdcf06b83760f143a0fba6885fa929
MD5 3ee01c075c850e116bcb7d70a2d4f964
SHA1 afa3cda2fb91bd0dd34317961402458f16be8d6b
SHA512 bf84fe5328555f8865eeb638b5267ea393dea0900dc3b0c9d60ed75fde5a9f4bd112127ea321661d1b51bb87e7b37fe45d65f58454779cebe07fb732a0cd6ef6
SSDEEP 98304:LMjCcSICqn6GEJGzSqoXCC98xPbXhDOJuZKl:QV9Cqn52pXC683OJWU
TLSH
T150B68D2C53A905F6D82AE679C692C633DAF0BD96532AC14F091DF5442F77E208B3F225
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6618088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource GetTokenInformation ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegEnumValueW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW RevertToSelf RegGetValueW

bcrypt

BCryptGetProperty BCryptGenRandom BCryptFinishHash BCryptExportKey BCryptEncrypt BCryptDestroyKey BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptImportKeyPair BCryptDecrypt

crypt32

PFXImportCertStore PFXExportCertStore CryptQueryObject CryptImportPublicKeyInfoEx2 CryptFormatObject CryptFindOIDInfo CryptDecodeObject CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertSerializeCertificateStoreElement CertSaveStore CertOpenStore CertNameToStrW CertGetValidUsages CertGetNameStringW CertGetIntendedKeyUsage CertAddCertificateContextToStore CertAddCertificateLinkToStore CertCloseStore CertControlStore CertCreateCertificateChainEngine CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty

iphlpapi

GetNetworkParams GetAdaptersAddresses GetPerAdapterInfo if_nametoindex

kernel32

RaiseException RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer AllocConsole CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeleteVolumeMountPointW DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCPInfo GetCPInfoExW GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadFile RemoveDirectoryW ResetEvent ResumeThread SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile OutputDebugStringW GetFileAttributesW GetModuleHandleW GetModuleHandleExW LoadLibraryA VirtualProtectEx GetModuleHandleExA FormatMessageA FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache CreateMemoryResourceNotification QueryInformationJobObject GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo HeapCreate HeapDestroy HeapAlloc HeapFree GetProcessHeap InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ncrypt

NCryptDeleteKey NCryptGetProperty NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptFreeObject NCryptSetProperty

ole32

CoWaitForMultipleHandles CoUninitialize CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoGetApartmentType CoInitializeEx

ws2_32

FreeAddrInfoW GetAddrInfoExW GetAddrInfoW GetNameInfoW WSACleanup WSAConnect WSAEventSelect WSAGetOverlappedResult WSAIoctl WSARecv WSASend WSASocketW WSAStartup bind closesocket getpeername getsockopt ioctlsocket recv select send setsockopt shutdown FreeAddrInfoExW

api-ms-win-crt-heap-l1-1-0

_aligned_malloc malloc free _aligned_free calloc _callnewh

api-ms-win-crt-math-l1-1-0

floor modf ceil

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initterm_e _initialize_narrow_environment terminate _cexit _initterm _errno _initialize_onexit_table _register_onexit_function _invoke_watson abort _invalid_parameter_noinfo_noreturn _crt_atexit _execute_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s strlen strcmp _stricmp toupper wcslen

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vsprintf _wfsopen __stdio_common_vswprintf fwrite fopen __stdio_common_vsnwprintf_s __stdio_common_vfwprintf fputwc fflush __stdio_common_vfprintf setvbuf

api-ms-win-crt-convert-l1-1-0

_wtoi strtoull wcstoul

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

_create_locale _free_locale

dbghelp

ImageDirectoryEntryToData

AcquireDDThreadLock CloseDriver CompleteCreateSysmemSurface CreateDirect3D11DeviceFromDXGIDevice CreateDirect3D11SurfaceFromDXGISurface D3D10CompileEffectFromMemory D3D10CompileShader D3D10CreateBlob D3D10CreateDevice D3D10CreateDeviceAndSwapChain D3D10CreateEffectFromMemory D3D10CreateEffectPoolFromMemory D3D10CreateStateBlock D3D10DisassembleEffect D3D10DisassembleShader D3D10GetGeometryShaderProfile D3D10GetInputAndOutputSignatureBlob D3D10GetInputSignatureBlob D3D10GetOutputSignatureBlob D3D10GetPixelShaderProfile D3D10GetShaderDebugInfo D3D10GetVersion D3D10GetVertexShaderProfile D3D10PreprocessShader D3D10ReflectShader D3D10RegisterLayers D3D10StateBlockMaskDifference D3D10StateBlockMaskDisableAll D3D10StateBlockMaskDisableCapture D3D10StateBlockMaskEnableAll D3D10StateBlockMaskEnableCapture D3D10StateBlockMaskGetSetting D3D10StateBlockMaskIntersect D3D10StateBlockMaskUnion D3D11CoreCreateDevice D3D11CoreCreateLayeredDevice D3D11CoreGetLayeredDeviceSize D3D11CoreRegisterLayers D3D11CreateDevice D3D11CreateDeviceAndSwapChain D3D11CreateDeviceForD3D12 D3D11On12CreateDevice D3D12CoreCreateLayeredDevice D3D12CoreGetLayeredDeviceSize D3D12CoreRegisterLayers D3D12CreateDevice D3D12CreateRootSignatureDeserializer D3D12CreateVersionedRootSignatureDeserializer D3D12DeviceRemovedExtendedData D3D12EnableExperimentalFeatures D3D12GetDebugInterface D3D12GetInterface D3D12PIXEventsReplaceBlock D3D12PIXGetThreadInfo D3D12PIXNotifyWakeFromFenceSignal D3D12PIXReportCounter D3D12SerializeRootSignature D3D12SerializeVersionedRootSignature D3DKMTCloseAdapter D3DKMTCreateAllocation D3DKMTCreateContext D3DKMTCreateDevice D3DKMTCreateSynchronizationObject D3DKMTDestroyAllocation D3DKMTDestroyContext D3DKMTDestroyDevice D3DKMTDestroySynchronizationObject D3DKMTEscape D3DKMTGetContextSchedulingPriority D3DKMTGetDeviceState D3DKMTGetDisplayModeList D3DKMTGetMultisampleMethodList D3DKMTGetRuntimeData D3DKMTGetSharedPrimaryHandle D3DKMTLock D3DKMTOpenAdapterFromHdc D3DKMTOpenResource D3DKMTPresent D3DKMTQueryAdapterInfo D3DKMTQueryAllocationResidency D3DKMTQueryResourceInfo D3DKMTRender D3DKMTSetAllocationPriority D3DKMTSetContextSchedulingPriority D3DKMTSetDisplayMode D3DKMTSetDisplayPrivateDriverFormat D3DKMTSetGammaRamp D3DKMTSetVidPnSourceOwner D3DKMTSignalSynchronizationObject D3DKMTUnlock D3DKMTWaitForSynchronizationObject D3DKMTWaitForVerticalBlankEvent D3DPERF_BeginEvent D3DPERF_EndEvent D3DPERF_GetStatus D3DPERF_QueryRepeatFrame D3DPERF_SetMarker D3DPERF_SetOptions D3DPERF_SetRegion D3DParseUnknownCommand D3DPerformance_BeginEvent D3DPerformance_EndEvent D3DPerformance_GetStatus D3DPerformance_SetMarker DDGetAttachedSurfaceLcl DDInternalLock DDInternalUnlock DSoundHelp DebugSetLevel DebugSetMute DefDriverProc Direct3D8EnableMaximizedWindowedModeShim Direct3D9EnableMaximizedWindowedModeShim Direct3DCreate8 Direct3DCreate9 Direct3DCreate9Ex Direct3DCreate9On12 Direct3DCreate9On12Ex Direct3DShaderValidatorCreate9 DirectDrawCreate DirectDrawCreateClipper DirectDrawCreateEx DirectDrawEnumerateA DirectDrawEnumerateExA DirectDrawEnumerateExW DirectDrawEnumerateW DirectInput8Create DirectInputCreateA DirectInputCreateEx DirectInputCreateW DirectSoundCaptureCreate DirectSoundCaptureCreate8 DirectSoundCaptureEnumerateA DirectSoundCaptureEnumerateW DirectSoundCreate DirectSoundCreate8 DirectSoundEnumerateA DirectSoundEnumerateW DirectSoundFullDuplexCreate DllCanUnloadNow DllGetClassObject DllMain DllRegisterServer DllUnregisterServer DotNetRuntimeDebugHeader DriverCallback DrvGetModuleHandle EnableFeatureLevelUpgrade GetBehaviorValue GetDDSurfaceLocal GetDeviceID GetDriverModuleHandle GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW GetLoaderConfig GetOLEThunkData GetSurfaceFromDC IsConsoleOpen LogError LogMelonInfo LogMsg MonoGetDomainPtr MonoGetRuntimeHandle MonoInstallHooks NativeHookAttach NativeHookDetach OpenAdapter10 OpenAdapter10_2 OpenDriver PSGPError PSGPSampleTexture PlaySound PlaySoundA PlaySoundW Private1 RegisterSpecialCase ReleaseDDThreadLock SendDriverMessage SetAppCompatData SetAppCompatStringPointer SvchostPushServiceGlobals ValidatePixelShader ValidateVertexShader VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW WOWAppExit WinHttpAddRequestHeaders WinHttpAddRequestHeadersEx WinHttpAutoProxySvcMain WinHttpCheckPlatform WinHttpCloseHandle WinHttpConnect WinHttpConnectionDeletePolicyEntries WinHttpConnectionDeleteProxyInfo WinHttpConnectionFreeNameList WinHttpConnectionFreeProxyInfo WinHttpConnectionFreeProxyList WinHttpConnectionGetNameList WinHttpConnectionGetProxyInfo WinHttpConnectionGetProxyList WinHttpConnectionOnlyConvert WinHttpConnectionOnlyReceive WinHttpConnectionOnlySend WinHttpConnectionSetPolicyEntries WinHttpConnectionSetProxyInfo WinHttpConnectionUpdateIfIndexTable WinHttpCrackUrl WinHttpCreateProxyList WinHttpCreateProxyManager WinHttpCreateProxyResolver WinHttpCreateProxyResult WinHttpCreateUiCompatibleProxyString WinHttpCreateUrl WinHttpDetectAutoProxyConfigUrl WinHttpFreeProxyResult WinHttpFreeProxyResultEx WinHttpFreeProxySettings WinHttpFreeProxySettingsEx WinHttpFreeQueryConnectionGroupResult WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpGetProxyForUrlEx WinHttpGetProxyForUrlEx2 WinHttpGetProxyForUrlHvsi WinHttpGetProxyResult WinHttpGetProxyResultEx WinHttpGetProxySettingsEx WinHttpGetProxySettingsResultEx WinHttpGetProxySettingsVersion WinHttpGetTunnelSocket WinHttpOpen WinHttpOpenRequest WinHttpPacJsWorkerMain WinHttpProbeConnectivity WinHttpProtocolCompleteUpgrade WinHttpProtocolReceive WinHttpProtocolSend WinHttpQueryAuthSchemes WinHttpQueryConnectionGroup WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpQueryHeadersEx WinHttpQueryOption WinHttpReadData WinHttpReadDataEx WinHttpReadProxySettings WinHttpReadProxySettingsHvsi WinHttpReceiveResponse WinHttpRefreshProxySettings WinHttpRegisterProxyChangeNotification WinHttpResetAutoProxy WinHttpResolverGetProxyForUrl WinHttpSaveProxyCredentials WinHttpSendRequest WinHttpSetCredentials WinHttpSetDefaultProxyConfiguration WinHttpSetOption WinHttpSetProxySettingsPerUser WinHttpSetSecureLegacyServersAppCompat WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpTimeFromSystemTime WinHttpTimeToSystemTime WinHttpUnregisterProxyChangeNotification WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketQueryCloseStatus WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketShutdown WinHttpWriteData WinHttpWriteProxySettings acmDriverAddA acmDriverAddW acmDriverClose acmDriverDetailsA acmDriverDetailsW acmDriverEnum acmDriverID acmDriverMessage acmDriverOpen acmDriverPriority acmDriverRemove acmFilterChooseA acmFilterChooseW acmFilterDetailsA acmFilterDetailsW acmFilterEnumA acmFilterEnumW acmFilterTagDetailsA acmFilterTagDetailsW acmFilterTagEnumA acmFilterTagEnumW acmFormatChooseA acmFormatChooseW acmFormatDetailsA acmFormatDetailsW acmFormatEnumA acmFormatEnumW acmFormatSuggest acmFormatTagDetailsA acmFormatTagDetailsW acmFormatTagEnumA acmFormatTagEnumW acmGetVersion acmMetrics acmStreamClose acmStreamConvert acmStreamMessage acmStreamOpen acmStreamPrepareHeader acmStreamReset acmStreamSize acmStreamUnprepareHeader auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume get_hostfxr_path joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion sndPlaySoundA sndPlaySoundW timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite