Module[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Module.dll
Size 3.1MB
Sample261020-thk7assscv
SHA256 c8124dfc116f67e458f042fedf0791d5d9e292d1637f1b61df2ec926f16828ee
MD5 8a700d81dac4febf6ca42d167c2ef815
SHA1 5126961a4f215c273fdf0627f9a6da68c3c6538f
SHA512 305fcc5840ce230b12aa7565d048d70a1167287dcf74b43058babd8a4d388af0b3fc9e71294323fbc027d5ab8768e5e263f88ce00ec37f64c8c40ed9d095b4c9
SSDEEP 49152:H1NywpYQ6S/WHmjWzJmkLb9q1zxXzFKJ5unahJ:VDhhC9UF
TLSH
T11CE59E62A5E800ECD177D0FCDB975A03E7B2B44503306AEB13E089692F27BE55B7E611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Module.dll

File Explorer

Module.dll

.dll 3.1MB

Module.dll

IMPHASH d5f8f73afc91a91006feed78f0509c06
SHA256 c8124dfc116f67e458f042fedf0791d5d9e292d1637f1b61df2ec926f16828ee
MD5 8a700d81dac4febf6ca42d167c2ef815
SHA1 5126961a4f215c273fdf0627f9a6da68c3c6538f
SHA512 305fcc5840ce230b12aa7565d048d70a1167287dcf74b43058babd8a4d388af0b3fc9e71294323fbc027d5ab8768e5e263f88ce00ec37f64c8c40ed9d095b4c9
SSDEEP 49152:H1NywpYQ6S/WHmjWzJmkLb9q1zxXzFKJ5unahJ:VDhhC9UF
TLSH
T11CE59E62A5E800ECD177D0FCDB975A03E7B2B44503306AEB13E089692F27BE55B7E611
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

2031568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\kuluc\Downloads\module\build\Rainy-Module.pdb

ws2_32

ioctlsocket WSAPoll getsockopt ntohs getsockname getpeername inet_pton WSASocketW shutdown getnameinfo WSAGetLastError accept bind closesocket ntohl listen getaddrinfo inet_addr send socket connect recv htons freeaddrinfo setsockopt WSACleanup WSAStartup

crypt32

CertCreateCertificateContext CryptBinaryToStringA CertGetCertificateChain CertFreeCertificateContext CertVerifyCertificateChainPolicy CertFreeCertificateChain CertCloseStore CertEnumCertificatesInStore CertOpenSystemStoreW

winhttp

WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpQueryDataAvailable WinHttpQueryHeaders

kernel32

InitOnceBeginInitialize MoveFileExA GetFileInformationByHandleEx GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW InitOnceComplete CopyFile2 AreFileApisANSI CreateFile2 GetFileInformationByHandle GetFileAttributesExW CreateDirectoryW GetModuleFileNameA GetCurrentProcess WriteFile ExpandEnvironmentStringsW OutputDebugStringA TerminateProcess CreateFileW GetCurrentThreadId GetModuleHandleA Sleep DisableThreadLibraryCalls GetLocalTime AddVectoredExceptionHandler ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers VirtualQuery InitOnceExecuteOnce SetFilePointer ReleaseSRWLockExclusive CreateFileA AcquireSRWLockExclusive ReadFile FindFirstFileW GetFileSizeEx HeapFree GetFullPathNameW FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW SetFileAttributesW MultiByteToWideChar GetTickCount64 GetLastError DeleteFileW CloseHandle HeapAlloc MoveFileExW GetProcessHeap CopyFileW WideCharToMultiByte GetVolumeInformationA GetComputerNameA GlobalAlloc GlobalFree GlobalLock GlobalUnlock IsBadReadPtr GetModuleHandleExW GetModuleFileNameW CreateProcessW VirtualFree VirtualAlloc FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetStdHandle WriteConsoleA SetConsoleMode ReadConsoleA GetConsoleMode FreeConsole FillConsoleOutputAttribute GetConsoleWindow SetConsoleOutputCP SetConsoleCursorPosition AllocConsole FormatMessageA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask GetModuleHandleW QueryPerformanceCounter GetLocaleInfoEx GetModuleHandleExA LocalFree InitializeSListHead

user32

GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState DestroyWindow MonitorFromWindow EnumDisplayMonitors CreateWindowExW ScreenToClient SetWindowTextW RegisterClassExW WindowFromPoint GetCapture GetMonitorInfoW ClientToScreen IsChild TrackMouseEvent SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect ReleaseCapture SetForegroundWindow IsIconic SetCursorPos GetCursorPos SetWindowPos ShowWindow GetWindowThreadProcessId keybd_event GetSystemMetrics OpenClipboard CloseClipboard EmptyClipboard MessageBoxA GetForegroundWindow GetClipboardData mouse_event SetClipboardData FindWindowA CallWindowProcW GetDC SetWindowLongPtrW ReleaseDC MessageBoxW

gdi32

GetDeviceCaps

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

CryptAcquireContextW GetCurrentHwProfileW CryptDestroyKey CryptEncrypt CryptGenRandom CryptDecrypt CryptReleaseContext CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash

shell32

SHGetFolderPathW SHGetPathFromIDListA SHBrowseForFolderA SHGetKnownFolderPath ShellExecuteA

ole32

CoTaskMemFree

msvcp140

_Xtime_get_ticks _Thrd_join ?tolower@?$ctype@D@std@@QEBADD@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Thrd_id ?_Random_device@std@@YAIXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Cnd_signal ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z __crtLCMapStringA ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency _Query_perf_counter ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ??_7facet@locale@std@@6B@ _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?uncaught_exceptions@std@@YAHXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCreateHash

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy _set_purecall_handler strrchr _purecall strchr wcsrchr __std_type_info_compare __RTtypeid strstr memcpy memmove memset memcmp __C_specific_handler_noexcept _CxxThrowException memchr __std_type_info_destroy_list __C_specific_handler __current_exception_context __current_exception

api-ms-win-crt-runtime-l1-1-0

_set_invalid_parameter_handler terminate signal _resetstkoflw _errno abort exit set_terminate _beginthreadex _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e

api-ms-win-crt-heap-l1-1-0

malloc realloc free calloc _callnewh

api-ms-win-crt-stdio-l1-1-0

_wfopen fseek setbuf fopen ftell __acrt_iob_func __stdio_common_vsscanf _get_stream_buffer_pointers _fseeki64 fread fsetpos __stdio_common_vswprintf_s ungetc setvbuf _wfopen_s fgetpos fwrite __stdio_common_vsprintf fgetc __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vfwprintf fflush fputc fclose

api-ms-win-crt-string-l1-1-0

_wcsicmp strncpy _stricmp strncpy_s strncmp strlen strcmp wcscpy_s strcpy_s _wcsnicmp tolower wcscat_s isalnum isalpha isspace toupper isblank strspn strcspn strncat islower isdigit ispunct iscntrl isxdigit isupper isgraph strpbrk wcslen

api-ms-win-crt-math-l1-1-0

sinf sinh sin sqrt llround sqrtf powf tan acos pow acosf logf log2 log10 tanh _dsign log asin atan cosh fmodf ldexp round modf frexp fmod floorf floor exp atan2 cosf cos ceilf ceil atan2f

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoll atof strtoul strtoull atoi

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func localeconv ___lc_collate_cp_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_difftime64 _gmtime64_s _localtime64_s strftime _time64 clock