Onno[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Onno.dll
Size 971KB
Sample261011-sheh3stsct
SHA256 65947a8aa5fc95891d2d7ec1cf567803924c0d27f3ee896009eb13d243161a5d
MD5 06624299620618017f15fdf88012ccc3
SHA1 b6bce2355fafc83cc365dfd105e617d9a815cac6
SHA512 a288e664189d50040112c89908db620a68bad9747644a8ef346ab18dc363e1120727a656c4e9a0f2d9749864ce597c8e91dd0a954814bf17489ffa4d4a076ba1
SSDEEP 24576:RRHUHctgXg1Y0wMXsibpi5navpFtdzARzP9:P081eS8aY5n2FttYzP
TLSH
T1EE25BF06F3A945FAC06B9138D993971BEB727809076096CF63E05E597FB37E01A7A301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Onno.dll

File Explorer

Onno.dll

.dll 971KB

Onno.dll

IMPHASH 9b5a7beb537df97186d1c8c590afacc0
SHA256 65947a8aa5fc95891d2d7ec1cf567803924c0d27f3ee896009eb13d243161a5d
MD5 06624299620618017f15fdf88012ccc3
SHA1 b6bce2355fafc83cc365dfd105e617d9a815cac6
SHA512 a288e664189d50040112c89908db620a68bad9747644a8ef346ab18dc363e1120727a656c4e9a0f2d9749864ce597c8e91dd0a954814bf17489ffa4d4a076ba1
SSDEEP 24576:RRHUHctgXg1Y0wMXsibpi5navpFtdzARzP9:P081eS8aY5n2FttYzP
TLSH
T1EE25BF06F3A945FAC06B9138D993971BEB727809076096CF63E05E597FB37E01A7A301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

424488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetLastError AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateMutexA Sleep GetCurrentProcessId CreateThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext GetLocalTime GetTickCount GetTickCount64 VirtualProtect VirtualQuery DisableThreadLibraryCalls FreeLibraryAndExitThread GetModuleFileNameA GetModuleHandleA GetProcAddress OpenMutexA WideCharToMultiByte CreateToolhelp32Snapshot Thread32First Thread32Next Module32FirstW Module32NextW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte CloseHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileAttributesA RtlCaptureStackBackTrace CreateFileW HeapSize ReadFile LoadLibraryExW TlsFree WriteConsoleW SetEndOfFile SetStdHandle ReleaseSRWLockExclusive RtlUnwind AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue

user32

LoadCursorA ClientToScreen SetCursor SetCursorPos GetClientRect IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW ScreenToClient GetCursorPos GetForegroundWindow SendInput GetAsyncKeyState DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA CallWindowProcW DefWindowProcA PostMessageW SendMessageTimeoutW RegisterWindowMessageA IsHungAppWindow

shell32

ShellExecuteA ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

597KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

165KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Onno.dll

d3d11

d3dcompiler_47

kernel32

user32

shell32

imm32

generic