sysdiag[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sysdiag.dll
Size 57KB
Sample261012-stblkab13w
SHA256 2b3e0266b8b8fad42a5489709f62e8f72c868422f8fee1ecde0c4f5a431512a7
MD5 a087f7e205b2415c4ddc9a424873a414
SHA1 3bebacbc364264b588380f1a8501d152fcb0a075
SHA512 ab72997143e8559a6b277d73623e5898e491a8a576b83545ef248fbd010147062dad2623fabf6762a3d68229b078d9c0436bf9baf2b1b5ecca878c8ddc3be8ec
SSDEEP 384:fx6/R93hNtcfp/LYp+ESK9FL13+gtet/9GLo:Z6593hNG3EB3+gglT
TLSH
T1B443E69AB59194FDCC1AC2B2CAF68271E771F0A805A27B1B0354CA361C75AB0BF3D54D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sysdiag.dll

File Explorer

sysdiag.dll

.dll 57KB

sysdiag.dll

IMPHASH b5abeeb8eca38bbabe4bdd0a834bbd17
SHA256 2b3e0266b8b8fad42a5489709f62e8f72c868422f8fee1ecde0c4f5a431512a7
MD5 a087f7e205b2415c4ddc9a424873a414
SHA1 3bebacbc364264b588380f1a8501d152fcb0a075
SHA512 ab72997143e8559a6b277d73623e5898e491a8a576b83545ef248fbd010147062dad2623fabf6762a3d68229b078d9c0436bf9baf2b1b5ecca878c8ddc3be8ec
SSDEEP 384:fx6/R93hNtcfp/LYp+ESK9FL13+gtet/9GLo:Z6593hNG3EB3+gglT
TLSH
T1B443E69AB59194FDCC1AC2B2CAF68271E771F0A805A27B1B0354CA361C75AB0BF3D54D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CopyFileA CreateMutexA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DisableThreadLibraryCalls EnterCriticalSection GetCurrentProcessId GetLastError GetLongPathNameA GetModuleFileNameA GetModuleHandleA GetNativeSystemInfo GetProcAddress GetTempPathA GetTimeZoneInformation InitializeCriticalSection LeaveCriticalSection OpenMutexA Process32First Process32Next Sleep TlsGetValue VirtualProtect VirtualQuery

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy strchr strstr

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fclose fopen fwrite

api-ms-win-crt-string-l1-1-0

_strdup _stricmp strlen strncmp strncpy

shell32

IsUserAnAdmin SHCreateDirectoryExA SHGetFolderPathA

shlwapi

PathFindFileNameA PathRemoveFileSpecA

wininet

HttpQueryInfoA InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

ws2_32

WSACleanup WSAStartup closesocket connect htons inet_pton recv send setsockopt socket

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

67B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sysdiag.dll

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

shell32

shlwapi

wininet

ws2_32

generic