Nature[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nature.dll
Size 15.8MB
Sample261027-c31daace44
SHA256 1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008
MD5 970422c6ada34518b5621607c40d3b16
SHA1 072ae7a9bdd57b13b0b1845e95b97ea557c0d339
SHA512 fb83c5098f73ce48b14300cc6dfcc7ca4facb18255b7e6c7f668429832f40d270549b8e9e75e6c19d82a140636a0e56f1f1de862555a105407105796db1da115
SSDEEP 196608:UTDAnytwViyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8Ihun:UTDAnytlE91thPhREMRFTIhuWo
TLSH
T107F6AD836219388BC061A7BC4403927DF19EF80D9B55C7F79AD7FC2A99E71811E11FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nature.dll

File Explorer

Nature.dll

.dll 15.8MB

Nature.dll

IMPHASH 5a2c1bae5d17d2964b309deaf3cf60e8
SHA256 1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008
MD5 970422c6ada34518b5621607c40d3b16
SHA1 072ae7a9bdd57b13b0b1845e95b97ea557c0d339
SHA512 fb83c5098f73ce48b14300cc6dfcc7ca4facb18255b7e6c7f668429832f40d270549b8e9e75e6c19d82a140636a0e56f1f1de862555a105407105796db1da115
SSDEEP 196608:UTDAnytwViyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8Ihun:UTDAnytlE91thPhREMRFTIhuWo
TLSH
T107F6AD836219388BC061A7BC4403927DF19EF80D9B55C7F79AD7FC2A99E71811E11FA8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3143664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d2d1

ord1

d3d11

D3D11On12CreateDevice

d3dcompiler_47

D3DCompile

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-1-0

CreateDirectoryW CreateFileA CreateFileW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW ReadFile SetEndOfFile SetFilePointerEx WriteFile

api-ms-win-core-memory-l1-1-1

CreateFileMappingFromApp MapViewOfFileFromApp

api-ms-win-core-processthreads-l1-1-0

CreateThread ExitProcess ExitThread GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetExitCodeThread GetStartupInfoW SetThreadPriority SwitchToThread TerminateProcess

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA FindResourceA

api-ms-win-core-errorhandling-l1-1-0

GetLastError RaiseException SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx GetSystemInfo GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree LocalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA LoadLibraryW

api-ms-win-core-string-l1-1-0

CompareStringEx CompareStringW GetStringTypeW MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-synch-l1-2-0

Sleep SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable

api-ms-win-core-memory-l1-1-0

MapViewOfFile UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery

ws2_32

WSAAccept WSACleanup WSAPoll WSASocketW WSAStartup bind closesocket freeaddrinfo getaddrinfo getnameinfo getpeername getsockname listen ntohs recv send setsockopt shutdown socket

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

version

GetFileVersionInfoSizeW

gameinput

ord1

user32

CallWindowProcW ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard FindWindowA GetAsyncKeyState GetClientRect GetClipboardData GetDpiForWindow GetKeyState GetKeyboardLayout LoadCursorA MapVirtualKeyExA MessageBoxW OpenClipboard RegisterClassExA SetClipboardData SetCursor SetCursorPos SetWindowLongPtrW SetWindowTextW ToUnicodeEx UnregisterClassA

shell32

SHGetKnownFolderPath ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive CreateEventA DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ReleaseSRWLockExclusive ReleaseSemaphore ResetEvent SetEvent TryAcquireSRWLockExclusive WaitForSingleObject WaitForSingleObjectEx

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA

api-ms-win-core-localization-l1-2-0

EnumSystemLocalesW FormatMessageA GetACP GetCPInfo GetLocaleInfoEx GetLocaleInfoW GetOEMCP GetUserDefaultLCID IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW GetCommandLineA GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetStdHandle SetEnvironmentVariableW SetStdHandle

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize

kernel32

IsBadReadPtr IsBadWritePtr

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler RemoveVectoredExceptionHandler

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

oleaut32

GetErrorInfo SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsFree FlsGetValue FlsSetValue

api-ms-win-core-console-l1-1-0

GetConsoleMode GetConsoleOutputCP ReadConsoleW WriteConsoleW

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nature.dll

d2d1

d3d11

d3dcompiler_47

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-0

ws2_32

winhttp

version

gameinput

user32

shell32

imm32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l1-1-0

kernel32

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-util-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-console-l1-1-0

generic