Zero[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Zero.dll
Size 1.4MB
Sample261017-2c8peads2l
SHA256 355df663f260cef97f4cb6b044fe18811c4c429a6b8c0fddef2230abee9f5093
MD5 92f9fd3015dadc87705a74b3962826fb
SHA1 04b4c40f29dedb8b55a8f5cb8e4d75e9206ba267
SHA512 6cc0079987cc0e07dadad4c98c26b996f8e95570bb5546010d1d574b10f9f03fdd8c59033576bc765141967e09d8d0f3682633cb2b99c25d4ea68973bb4e8d58
SSDEEP 24576:/tWvv1ZgeeTEMUhcHO/ojmBiS6GyBnTcqcH25NzjMZzUwik50cZOm+bJtr+Qk:/MmTGyBn7NKzUk50cJSJtrB
TLSH
T13065BF40F6568271C64D24747A6EBBAF513D28641B2494C3F3F029D999E03F32AF7B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Zero.dll

File Explorer

Zero.dll

.dll 1.4MB

Zero.dll

IMPHASH d50d3c49d8c4660db397adfbcfac5055
SHA256 355df663f260cef97f4cb6b044fe18811c4c429a6b8c0fddef2230abee9f5093
MD5 92f9fd3015dadc87705a74b3962826fb
SHA1 04b4c40f29dedb8b55a8f5cb8e4d75e9206ba267
SHA512 6cc0079987cc0e07dadad4c98c26b996f8e95570bb5546010d1d574b10f9f03fdd8c59033576bc765141967e09d8d0f3682633cb2b99c25d4ea68973bb4e8d58
SSDEEP 24576:/tWvv1ZgeeTEMUhcHO/ojmBiS6GyBnTcqcH25NzjMZzUwik50cZOm+bJtr+Qk:/MmTGyBn7NKzUk50cJSJtrB
TLSH
T13065BF40F6568271C64D24747A6EBBAF513D28641B2494C3F3F029D999E03F32AF7B4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

770144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

kernel32

GetCurrentProcess GetModuleHandleA K32GetModuleInformation CreateDirectoryA VirtualQuery ReadFile CancelIo WriteFile GetEnvironmentVariableA WaitForSingleObject Sleep GetLastError CreateFileA CloseHandle GetOverlappedResult CreateEventA FreeLibraryAndExitThread DisableThreadLibraryCalls LoadLibraryA CreateThread GetProcAddress VirtualProtect GetModuleFileNameA GetVolumeInformationA GetFileAttributesA GetSystemDirectoryA DeleteFileA GetSystemInfo GetLocalTime GetComputerNameA MultiByteToWideChar InitializeSListHead SleepConditionVariableSRW FindNextFileA FindClose VirtualFree VirtualAlloc HeapCreate HeapFree Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId IsProcessorFeaturePresent SetThreadContext OpenThread OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter GetSystemTimeAsFileTime WakeAllConditionVariable FindFirstFileA AcquireSRWLockExclusive ReleaseSRWLockExclusive WideCharToMultiByte FlushInstructionCache

user32

GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW LoadImageA GetDC GetKeyNameTextA MapVirtualKeyA ClipCursor SetWindowLongW ShowCursor ReleaseDC GetCursorPos GetAsyncKeyState SetCursorPos

gdi32

GetObjectA GetDIBits DeleteObject

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitialize CoUninitialize

msvcp140

?tolower@?$ctype@D@std@@QBEDD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z _Xtime_get_ticks _Strcoll ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ _Strxfrm _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ __crtLCMapStringA ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ?_Random_device@std@@YAIXZ ?_Xbad_alloc@std@@YAXXZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ?id@?$collate@D@std@@2V0locale@2@A

winmm

timeGetTime

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

urlmon

URLDownloadToFileA

wininet

HttpOpenRequestA InternetCrackUrlA HttpAddRequestHeadersA InternetOpenA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle

vcruntime140

__current_exception strrchr _purecall __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 strchr __std_type_info_compare __RTtypeid memchr __std_type_info_destroy_list _CxxThrowException __current_exception_context _except_handler4_common memset memmove memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fputs __stdio_common_vfscanf _wfopen __stdio_common_vsprintf fflush __acrt_iob_func fwrite fclose fread fopen fgets __stdio_common_vsprintf_s ftell fseek __stdio_common_vsscanf

api-ms-win-crt-convert-l1-1-0

strtoul atoll atof

api-ms-win-crt-string-l1-1-0

strncpy strncmp strtok_s isxdigit isalnum _wcsnicmp isspace toupper isblank tolower

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _beginthreadex _seh_filter_dll terminate

api-ms-win-crt-math-l1-1-0

_libm_sse2_exp_precise _libm_sse2_log_precise _CIfmod _libm_sse2_pow_precise _CIatan2 _libm_sse2_sin_precise _fdclass _libm_sse2_sqrt_precise _libm_sse2_acos_precise _libm_sse2_tan_precise ceil floor _libm_sse2_cos_precise

api-ms-win-crt-time-l1-1-0

_mktime64 _time64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_collate_cp_func