rex_sp[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rex_sp.dll
Size 2.6MB
Sample261020-yr6a2set6w
SHA256 3f745a446fd1242f0303c2220acc931136acdef1200090eb783a09dec1457a29
MD5 9d4ba42772bc2df855813ed9a651d025
SHA1 5b441fe7f8225b8d77bff895ba22cd452f2b3896
SHA512 41448ba57a80eb8cb4801075f34c65494a8200cbd22de3b896a2b73cc752393bb63909179d38d00a5201a682c637d2bbcf703109fe5417198ea6d5427ac97375
SSDEEP 49152:m4O6fKbBUAykgLg3iWl3nnL1GD9EZM9O2fOuSiAUVe/Hkmd:JfK9ek2g3iWl3nRGD9D95ECOHkO
TLSH
T10AD53356779F4152E6AFD47887591BC3A76139CA42C03BC6B3340DD60AA2EDCBDBA304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rex_sp.dll

File Explorer

rex_sp.dll

.dll 2.6MB

rex_sp.dll

IMPHASH 72220ebf60510fbf7d8d2b9b0cf30167
SHA256 3f745a446fd1242f0303c2220acc931136acdef1200090eb783a09dec1457a29
MD5 9d4ba42772bc2df855813ed9a651d025
SHA1 5b441fe7f8225b8d77bff895ba22cd452f2b3896
SHA512 41448ba57a80eb8cb4801075f34c65494a8200cbd22de3b896a2b73cc752393bb63909179d38d00a5201a682c637d2bbcf703109fe5417198ea6d5427ac97375
SSDEEP 49152:m4O6fKbBUAykgLg3iWl3nnL1GD9EZM9O2fOuSiAUVe/Hkmd:JfK9ek2g3iWl3nRGD9D95ECOHkO
TLSH
T10AD53356779F4152E6AFD47887591BC3A76139CA42C03BC6B3340DD60AA2EDCBDBA304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess TerminateProcess VirtualQuery VirtualAlloc Sleep GetLastError GetCurrentProcessId GetPrivateProfileStringA Thread32First Thread32Next HeapFree VirtualProtect HeapCreate SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc CloseHandle HeapAlloc GetThreadContext FlushInstructionCache SetThreadContext OpenThread VirtualFree GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetCurrentThreadId

user32

GetAsyncKeyState

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?good@ios_base@std@@QEBA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy __std_exception_copy __std_exception_destroy __std_terminate __C_specific_handler __std_type_info_destroy_list _CxxThrowException memmove

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __acrt_iob_func __stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _errno terminate _beginthreadex _crt_atexit _configure_narrow_argv _execute_onexit_table _initterm _register_onexit_function _invoke_watson _initterm_e _cexit _initialize_narrow_environment _initialize_onexit_table

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.5MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

rex_sp.dll

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic