SLC[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SLC.dll.exe
Size 2.9MB
Sample261003-yr75msfc46
SHA256 1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da
MD5 277529fc1204337be437c4459d743d34
SHA1 7a41a44a451563e56f97a376f79f5c9b2b8ce7bd
SHA512 29993cf0d0cb0a69cee3d48635d90c719c5bc3975a6a5730bc5add8676b3f75f43501c6eaaf85f8d3195a4aef91a4f03417f1c2ad228357dbc1b6533dd166247
SSDEEP 49152:gchiGLYRCdrrLN9HOSwo3WKTVUhtB4xgKK2iJi:XrLv53Uw
TLSH
T1FBE52843E66690F8C169C078875B6633EB72B88A07357AEB17E04B343F66F90663C745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SLC.dll.exe

File Explorer

SLC.dll.exe

.dll 2.9MB

SLC.dll.exe

IMPHASH 240a5c324770ca67d2d667489a154f60
SHA256 1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da
MD5 277529fc1204337be437c4459d743d34
SHA1 7a41a44a451563e56f97a376f79f5c9b2b8ce7bd
SHA512 29993cf0d0cb0a69cee3d48635d90c719c5bc3975a6a5730bc5add8676b3f75f43501c6eaaf85f8d3195a4aef91a4f03417f1c2ad228357dbc1b6533dd166247
SSDEEP 49152:gchiGLYRCdrrLN9HOSwo3WKTVUhtB4xgKK2iJi:XrLv53Uw
TLSH
T1FBE52843E66690F8C169C078875B6633EB72B88A07357AEB17E04B343F66F90663C745
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2208608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

slc_template.pdb

bcryptprimitives

ProcessPrng

kernel32

FindNextFileW VirtualQuery FindFirstFileExW SetFileInformationByHandle GetNativeSystemInfo DeleteFileW GetProcAddress FindClose GetFinalPathNameByHandleW SetFileCompletionNotificationModes CreateWaitableTimerExW GetSystemTimePreciseAsFileTime SetLastError HeapSize SetWaitableTimer ReadConsoleW SetStdHandle FlushFileBuffers Sleep CreateFileMappingW MapViewOfFile VirtualFree UnmapViewOfFile GetModuleHandleW SetHandleInformation GetStdHandle GetConsoleMode GetConsoleOutputCP GetComputerNameExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA ReleaseMutex AddVectoredExceptionHandler FormatMessageW GetTempPathW GetModuleFileNameW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW CreateFileW CreateDirectoryW GetFileType InitializeCriticalSectionEx FlsFree GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateThread SetThreadStackGuarantee GetCurrentThread SleepEx ExitProcess HeapAlloc TerminateProcess UnregisterWaitEx FlsSetValue FlsGetValue LoadLibraryExA FreeLibrary FlsAlloc GetModuleHandleExW RtlPcToFileHeader VirtualAlloc WriteConsoleW LoadLibraryExW TlsFree GetExitCodeProcess RegisterWaitForSingleObject GetCurrentThreadId VirtualProtect WaitForSingleObject SetFilePointerEx CloseHandle CopyFileExW GetCurrentProcessId GetModuleHandleExA GetLastError GetModuleFileNameA GetModuleHandleA HeapReAlloc HeapFree GetProcessHeap SwitchToThread GetSystemInfo TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer InterlockedFlushSList RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwind ReadFileEx CompareStringOrdinal QueryPerformanceFrequency GetStringTypeW ReadFile WriteFile GetEnvironmentVariableW WideCharToMultiByte lstrlenW WriteFileEx MultiByteToWideChar PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCommandLineA GetCurrentDirectoryW GetCommandLineW GetCPInfo GetOEMCP LCMapStringW GetACP IsValidCodePage

oleaut32

SysFreeString SysStringLen GetErrorInfo SysAllocStringLen

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtReadFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

crypt32

CertDuplicateStore CertOpenStore CertVerifyCertificateChainPolicy CertCloseStore CertFreeCertificateContext CertFreeCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertDuplicateCertificateContext

ws2_32

shutdown getaddrinfo freeaddrinfo WSAStartup WSACleanup recv send getsockname WSAGetLastError getpeername closesocket bind setsockopt ioctlsocket WSASocketW WSASend WSAIoctl getsockopt connect

secur32

DeleteSecurityContext QueryContextAttributesW AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer FreeCredentialsHandle DecryptMessage ApplyControlToken EncryptMessage AcquireCredentialsHandleA

advapi32

GetUserNameW

ole32

CoInitialize CoCreateInstance CoUninitialize

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

493KB

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cfg

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SLC.dll.exe

bcryptprimitives

kernel32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

crypt32

ws2_32

secur32

advapi32

ole32

generic