rex_sp[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rex_sp.dll
Size 2.4MB
Sample261023-ank9psvxcs
SHA256 89328a225f7a24fd445e04aa939a309df87a55d709fb7914bd9df5abc50b3680
MD5 4254dd61f7b3d1b6b8f76c10a6340c9b
SHA1 1001923f028628c37714811ea3edef00dfa4d2f1
SHA512 12282a84219b1f775ced86bf7e60bfeef2d67a82ef4d9e1268151e4296d237f2b34bb2952820c5829133ee497ef151b842ac028f2ba7966042d418950cebacdf
SSDEEP 49152:F7XFGuJLkTDMx/oR9x6PjWE31RtMhhzJZVRIPu4TGqegq2:3LiDbkprI3Tp4K0
TLSH
T171C5332BFB1D207AE315C5B4C7860BDB2A627C955980BF9763100EF54D92EAC3A6D3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rex_sp.dll

File Explorer

rex_sp.dll

.dll 2.4MB

rex_sp.dll

IMPHASH 1f51d0e4d28c9b46421cc12132ba2d3a
SHA256 89328a225f7a24fd445e04aa939a309df87a55d709fb7914bd9df5abc50b3680
MD5 4254dd61f7b3d1b6b8f76c10a6340c9b
SHA1 1001923f028628c37714811ea3edef00dfa4d2f1
SHA512 12282a84219b1f775ced86bf7e60bfeef2d67a82ef4d9e1268151e4296d237f2b34bb2952820c5829133ee497ef151b842ac028f2ba7966042d418950cebacdf
SSDEEP 49152:F7XFGuJLkTDMx/oR9x6PjWE31RtMhhzJZVRIPu4TGqegq2:3LiDbkprI3Tp4K0
TLSH
T171C5332BFB1D207AE315C5B4C7860BDB2A627C955980BF9763100EF54D92EAC3A6D3C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49132

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess TerminateProcess VirtualQuery VirtualAlloc Sleep GetLastError GetCurrentProcessId Thread32Next HeapFree VirtualProtect HeapCreate GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc CloseHandle HeapAlloc GetThreadContext FlushInstructionCache SetThreadContext OpenThread VirtualFree GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead Thread32First

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy _CxxThrowException __std_exception_copy __std_exception_destroy __std_terminate __C_specific_handler __std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __acrt_iob_func __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _cexit _initialize_narrow_environment _initialize_onexit_table _initterm_e _crt_atexit _invoke_watson _execute_onexit_table _register_onexit_function _initterm

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.4MB

Virtual Size

12.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

rex_sp.dll

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic