winhttp[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
winhttp.dll
Size 1.8MB
Sample261018-rvzjca1sft
SHA256 03d1dec44990438cd85dc39edb2b86c655eae850ca0044c49acdfd83e4c5f179
MD5 e817974c61554b6a121d866c4bbed0d6
SHA1 14904984ea6f4ee4b37f0b5f2e2869b473849e15
SHA512 6f59cf633704d37920b31715ccdd466d103e023aac9fd3f9be059ef5ec63219626b0a0ed20fc95e25fa86ac05d5f51d4cd7cb95d20dd9dcfce0e33e07254988e
SSDEEP 24576:i0DaAzlGtU6NKjRIWEbktqVYPcz6OdlDAU5bqf4quZUm0d9QNc4nrh0lhSMXlpAY:BDaAzlGvERIWE+PmlFblAd9QNc4naw
TLSH
T1F495AE56B2E401FCD0BBE078CA57A60BF7B1341807609ADB23E445592FB7BE11ABB711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winhttp.dll

File Explorer

winhttp.dll

.dll 1.8MB

winhttp.dll

IMPHASH 5e5c2c8e0f756825866b0b09fd84ff02
SHA256 03d1dec44990438cd85dc39edb2b86c655eae850ca0044c49acdfd83e4c5f179
MD5 e817974c61554b6a121d866c4bbed0d6
SHA1 14904984ea6f4ee4b37f0b5f2e2869b473849e15
SHA512 6f59cf633704d37920b31715ccdd466d103e023aac9fd3f9be059ef5ec63219626b0a0ed20fc95e25fa86ac05d5f51d4cd7cb95d20dd9dcfce0e33e07254988e
SSDEEP 24576:i0DaAzlGtU6NKjRIWEbktqVYPcz6OdlDAU5bqf4quZUm0d9QNc4nrh0lhSMXlpAY:BDaAzlGvERIWE+PmlFblAd9QNc4naw
TLSH
T1F495AE56B2E401FCD0BBE078CA57A60BF7B1341807609ADB23E445592FB7BE11ABB711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1089708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

winhttp.pdb

kernel32

FlushInstructionCache GetCurrentProcess LoadLibraryW FreeLibrary VirtualAlloc GetSystemDirectoryW VirtualFree TerminateProcess InitializeSRWLock AcquireSRWLockExclusive TryAcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThread MultiByteToWideChar FlushFileBuffers GetLastError GetCurrentThreadId GetDynamicTimeZoneInformation WideCharToMultiByte GetStdHandle WriteFile GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute SuspendThread ResumeThread GetThreadContext SetThreadContext VirtualQuery SetLastError LoadLibraryExW VirtualProtect GlobalUnlock GetEnvironmentVariableA GlobalFree QueryPerformanceCounter QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA CreateEventA WriteConsoleW SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetModuleHandleExW GetModuleHandleW GetModuleFileNameW CloseHandle GetFileSizeEx SetFilePointerEx GetConsoleOutputCP HeapAlloc WaitForSingleObject GetModuleHandleA GetProcAddress GlobalAlloc GetCurrentProcessId HeapFree ExitProcess ReadFile GlobalLock IsDebuggerPresent FormatMessageA LocalFree GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader RaiseException InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwindEx InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType SetStdHandle RtlUnwind

user32

OpenClipboard CallWindowProcA SetWindowLongPtrA MessageBoxW CloseClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData

shell32

ShellExecuteA

ole32

CoCreateGuid

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

DllCanUnloadNow DllGetClassObject Private1 SvchostPushServiceGlobals WinHttpAddRequestHeaders WinHttpAddRequestHeadersEx WinHttpAutoProxySvcMain WinHttpCheckPlatform WinHttpCloseHandle WinHttpConnect WinHttpConnectionDeletePolicyEntries WinHttpConnectionDeleteProxyInfo WinHttpConnectionFreeNameList WinHttpConnectionFreeProxyInfo WinHttpConnectionFreeProxyList WinHttpConnectionGetNameList WinHttpConnectionGetProxyInfo WinHttpConnectionGetProxyList WinHttpConnectionSetPolicyEntries WinHttpConnectionSetProxyInfo WinHttpConnectionUpdateIfIndexTable WinHttpCrackUrl WinHttpCreateProxyResolver WinHttpCreateUrl WinHttpDetectAutoProxyConfigUrl WinHttpFreeProxyResult WinHttpFreeProxyResultEx WinHttpFreeProxySettings WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpGetProxyForUrlEx WinHttpGetProxyForUrlEx2 WinHttpGetProxyForUrlHvsi WinHttpGetProxyResult WinHttpGetProxyResultEx WinHttpGetProxySettingsVersion WinHttpGetTunnelSocket WinHttpOpen WinHttpOpenRequest WinHttpPacJsWorkerMain WinHttpProbeConnectivity WinHttpQueryAuthSchemes WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpQueryHeadersEx WinHttpQueryOption WinHttpReadData WinHttpReadDataEx WinHttpReadProxySettings WinHttpReadProxySettingsHvsi WinHttpReceiveResponse WinHttpResetAutoProxy WinHttpSaveProxyCredentials WinHttpSendRequest WinHttpSetCredentials WinHttpSetDefaultProxyConfiguration WinHttpSetOption WinHttpSetProxySettingsPerUser WinHttpSetSecureLegacyServersAppCompat WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpTimeFromSystemTime WinHttpTimeToSystemTime WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketQueryCloseStatus WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketShutdown WinHttpWriteData WinHttpWriteProxySettings

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

458KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winhttp.dll

kernel32

user32

shell32

ole32

imm32

d3dcompiler_47

generic