kff1f7d[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
kff1f7d.dll
Size 113KB
Sample261014-25f5vsae29
SHA256 e41219c50ff6fc3aacfd35b44478ef717dfc7a027698de14403c8e8f49e2ca3b
MD5 6a63a1cbb581d37050e9057aeccbb1bb
SHA1 116fafdc5f804be57867d591d4fb9f6cdfe752b8
SHA512 6f8bb9d05acf43484a47d5b9458817b84891e27916892348d0be29d2a82c7f491764b3fc4d7a42d3a83a1373f04111722d1bf45e062e76ebe5ef6b9c5f677cbf
SSDEEP 1536:16Ec1xG2sY/6CRCFdekZ/Y0h/DlPYRpiTB69yuOfM1Z4iqJ6:1Vc3NEeeY0XQRpiTBmOqRq
TLSH
T160B3830E36B904B1E565C07AE946462ACEA17046033D67FF5781C9C8AF717ECBE3CA61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kff1f7d.dll

File Explorer

kff1f7d.dll

.dll 113KB

kff1f7d.dll

IMPHASH 83e7eef4e3c91cc9c2f390fbecc6aec8
SHA256 e41219c50ff6fc3aacfd35b44478ef717dfc7a027698de14403c8e8f49e2ca3b
MD5 6a63a1cbb581d37050e9057aeccbb1bb
SHA1 116fafdc5f804be57867d591d4fb9f6cdfe752b8
SHA512 6f8bb9d05acf43484a47d5b9458817b84891e27916892348d0be29d2a82c7f491764b3fc4d7a42d3a83a1373f04111722d1bf45e062e76ebe5ef6b9c5f677cbf
SSDEEP 1536:16Ec1xG2sY/6CRCFdekZ/Y0h/DlPYRpiTB69yuOfM1Z4iqJ6:1Vc3NEeeY0XQRpiTBmOqRq
TLSH
T160B3830E36B904B1E565C07AE946462ACEA17046033D67FF5781C9C8AF717ECBE3CA61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\jtmcc\Downloads\SourceCode\Dll2\x64\Debug\Dll2.pdb

kernel32

CreateThread DisableThreadLibraryCalls GetCurrentThreadId GetModuleHandleA HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot GetLastError HeapReAlloc CloseHandle HeapAlloc HeapDestroy GetThreadContext GetProcAddress GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext Sleep VirtualFree VirtualAlloc GetSystemInfo VirtualQuery TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared FreeLibrary GetProcessHeap InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive Beep OpenThread GetTickCount64

user32

LoadCursorW SetWindowTextA SetForegroundWindow MessageBoxA GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW AttachThreadInput DefWindowProcW PostQuitMessage RegisterClassA CreateWindowExA DestroyWindow ShowWindow SetWindowPos IsWindowVisible BringWindowToTop GetAsyncKeyState GetForegroundWindow GetWindowThreadProcessId

msvcp140d

?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_counter _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Thrd_join _Thrd_id _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ

comctl32

InitCommonControlsEx

vcruntime140d

__std_exception_destroy _CxxThrowException __C_specific_handler __current_exception __current_exception_context __C_specific_handler_noexcept __std_type_info_destroy_list __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy __std_exception_copy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _CrtDbgReportW malloc _initterm_e strcat_s _wmakepath_s _wsplitpath_s wcscpy_s _beginthreadex __acrt_iob_func strcpy_s wcslen _free_dbg _initterm terminate getenv_s ceilf lround fopen_s _calloc_dbg __stdio_common_vsscanf __stdio_common_vsprintf_s _callnewh __stdio_common_vfprintf fgets _cexit fclose _CrtDbgReport

Name

.text

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

356B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

kff1f7d.dll

kernel32

user32

msvcp140d

comctl32

vcruntime140d

vcruntime140_1d

ucrtbased

generic