audioplayers_windows_plugin[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
audioplayers_windows_plugin.dll
Size 203KB
Sample261003-mnsp1awgla
SHA256 5fa39a7b18abe91c9ae6b7a2ea0ce6725d314ac2f779c775c44af3a6e504df61
MD5 01f022c50d3fc56c9ce16b58215898b9
SHA1 612c1d0fe17666f4587522c1d43e7f3168f36751
SHA512 03d1a19e3d629775bbe7de6cb2e9e70dd4fab0840047cbf0552e3c87bca02bbd11a98184a130624d2e0a9df39472031f164f7e4c433b045701fea5b28499c919
SSDEEP 6144:8UMgkmu6KQ6Sa+iLIVklaRP5v7tZxYgz6Be/0:8UMSoYiLkRP5vjxYgz6B
TLSH
T181143B2EB669409AE227D07CCD470A4AF77378950761A7CB679007BE1F17BE89E3D600
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
audioplayers_windows_plugin.dll

File Explorer

audioplayers_windows_plugin.dll

.dll 203KB

audioplayers_windows_plugin.dll

IMPHASH e370e48ff397fb8b9a341e408c914e02
SHA256 5fa39a7b18abe91c9ae6b7a2ea0ce6725d314ac2f779c775c44af3a6e504df61
MD5 01f022c50d3fc56c9ce16b58215898b9
SHA1 612c1d0fe17666f4587522c1d43e7f3168f36751
SHA512 03d1a19e3d629775bbe7de6cb2e9e70dd4fab0840047cbf0552e3c87bca02bbd11a98184a130624d2e0a9df39472031f164f7e4c433b045701fea5b28499c919
SSDEEP 6144:8UMgkmu6KQ6Sa+iLIVklaRP5v7tZxYgz6Be/0:8UMSoYiLkRP5vjxYgz6B
TLSH
T181143B2EB669409AE227D07CCD470A4AF77378950761A7CB679007BE1F17BE89E3D600
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW GetModuleFileNameA DisableThreadLibraryCalls LoadLibraryExW FreeLibrary GetModuleHandleExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection SetEvent ReleaseSRWLockExclusive CreateEventExW AcquireSRWLockExclusive DeleteCriticalSection InitializeCriticalSectionEx WaitForSingleObjectEx LeaveCriticalSection

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError

api-ms-win-core-com-l1-1-0

CoCreateInstance CoUninitialize CoInitializeEx CoGetApartmentType CoCreateFreeThreadedMarshaler

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo SysAllocString

shlwapi

ord12

flutter_windows

FlutterDesktopPluginRegistrarSetDestructionHandler FlutterDesktopPluginRegistrarGetView FlutterDesktopMessengerSend FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSetCallback FlutterDesktopMessengerAddRef FlutterDesktopMessengerRelease FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerLock FlutterDesktopMessengerUnlock FlutterDesktopTextureRegistrarRegisterExternalTexture FlutterDesktopTextureRegistrarUnregisterExternalTexture FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable FlutterDesktopPluginRegistrarGetMessenger FlutterDesktopRegistrarGetTextureRegistrar

kernel32

LoadLibraryExA GetSystemInfo VirtualProtect VirtualQuery RaiseException

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA _Thrd_detach

vcruntime140

__current_exception _purecall __std_terminate __std_type_info_destroy_list _CxxThrowException __std_exception_destroy memcmp memcpy __std_exception_copy memset __std_type_info_compare memmove __current_exception_context __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

terminate _invalid_parameter_noinfo _errno _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e _seh_filter_dll abort

api-ms-win-crt-string-l1-1-0

strlen iswspace wcslen

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vswprintf_s __stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException