Paradox[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Paradox.dll
Size 1.8MB
Sample261002-vcblcastct
SHA256 09cfc93f4da813cefa5f436e00178e212dbe05a1bacda39dd0030318fd0802bc
MD5 438c1528d6069eb1f59a9ade80241834
SHA1 2c8156fb08645f16715f856d4de0b263b98cd819
SHA512 4edb4afd86077c7aa529fcb23a242685ed7804a7328ebb7416bda5c31a374574250ce58839bc9fb38098da522bf8fafe65419218c663e71148dd2ddc21ddfdca
SSDEEP 49152:NdfS6YDWauWlmmJlgle54j07Bqpn64oLs7+:mTDTuWgmLgle5y07fLb
TLSH
T14E95AD57B1E14655D1D941388C53DB1B87203C058F524AEB33E4B66ABEF32E23E39E98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Paradox.dll

File Explorer

Paradox.dll

.dll 1.8MB

Paradox.dll

IMPHASH 1e064824b389465db4edd045d0f4d1b2
SHA256 09cfc93f4da813cefa5f436e00178e212dbe05a1bacda39dd0030318fd0802bc
MD5 438c1528d6069eb1f59a9ade80241834
SHA1 2c8156fb08645f16715f856d4de0b263b98cd819
SHA512 4edb4afd86077c7aa529fcb23a242685ed7804a7328ebb7416bda5c31a374574250ce58839bc9fb38098da522bf8fafe65419218c663e71148dd2ddc21ddfdca
SSDEEP 49152:NdfS6YDWauWlmmJlgle54j07Bqpn64oLs7+:mTDTuWgmLgle5y07fLb
TLSH
T14E95AD57B1E14655D1D941388C53DB1B87203C058F524AEB33E4B66ABEF32E23E39E98
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

493516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\User\Desktop\Stuff\Boost\Paradox-master\x64\Release\Boost-noskid.pdb

kernel32

FreeLibraryAndExitThread Sleep CreateThread GetCurrentProcess WaitForSingleObject GetModuleHandleA DisableThreadLibraryCalls K32GetModuleInformation CreateEventA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo VirtualQuery HeapCreate VirtualProtect HeapFree Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId FlushInstructionCache GetProcAddress OpenThread GetTickCount64 CloseHandle InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLastError GetFileAttributesW CreateFileW GetLocaleInfoEx LoadLibraryExA GetModuleFileNameA SetThreadContext LocalFree FormatMessageA CreateDirectoryW

user32

GetKeyNameTextA VkKeyScanA FindWindowA DestroyWindow CreateWindowExA UnregisterClassA RegisterClassExA GetMessageExtraInfo GetCursorPos DefWindowProcA MapVirtualKeyA CallWindowProcA GetAsyncKeyState LoadCursorA GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard ScreenToClient GetKeyState SetClipboardData GetClipboardData SetWindowLongPtrA

ole32

CoInitializeEx

msvcp140

?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??Bios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdstate@ios_base@std@@QEBAHXZ _Query_perf_frequency _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z _Mtx_lock _Mtx_unlock ?id@?$ctype@D@std@@2V0locale@2@A ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list _CxxThrowException __current_exception_context __current_exception memset memcpy memchr memmove strstr __C_specific_handler _purecall __std_terminate __std_exception_copy __std_exception_destroy memcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf __stdio_common_vsscanf __stdio_common_vsprintf fwrite __stdio_common_vsprintf_s __stdio_common_vfprintf fgetc __acrt_iob_func fclose fflush fseek fgetpos _wfopen fputc

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

abort _seh_filter_dll _invoke_watson _initterm_e _initialize_narrow_environment _initialize_onexit_table _initterm _cexit _errno _crt_atexit _beginthreadex _execute_onexit_table terminate _register_onexit_function _configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

strtoul strtoull strtod strtoll

api-ms-win-crt-string-l1-1-0

_stricmp strcmp tolower

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

_dsign sqrtf powf floorf _dclass _fdclass sinf fmodf acosf cosf ceilf expf

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64