aimwhere[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
aimwhere.dll
Size 29.7MB
Sample261027-szhbasd18x
SHA256 9852c842af083df398ad939cc46374a0b4b3be08cdb5ad3cd3848ce7d8cd89cb
MD5 6991c4ee4f8197ebac3966c29e0d5000
SHA1 ea10aa9dc52638202161983def3c99385b90229a
SHA512 9f4671cb3c29c80ee2b6027e3263f86a50d3bca1bc4da8d7420918c61593b6b5e689760588c9efdbfb20775d9f5a075e9093943b4cd435aec53810ef9c48057b
SSDEEP 786432:s3YMu8r7ULViftTFfTsB6BXGprNE4Q51n2Wt1WuvSBAe:attr7ActgpEP2W3AA
TLSH
T1AE6733EBD1EBD39888815AD87D4A01CB7884608EC9ED47392D8FEC1175D1C7E05CEAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aimwhere.dll

File Explorer

aimwhere.dll

.dll 29.7MB

aimwhere.dll

IMPHASH 5cbdee6654ab4d8d77d23fdb54373eea
SHA256 9852c842af083df398ad939cc46374a0b4b3be08cdb5ad3cd3848ce7d8cd89cb
MD5 6991c4ee4f8197ebac3966c29e0d5000
SHA1 ea10aa9dc52638202161983def3c99385b90229a
SHA512 9f4671cb3c29c80ee2b6027e3263f86a50d3bca1bc4da8d7420918c61593b6b5e689760588c9efdbfb20775d9f5a075e9093943b4cd435aec53810ef9c48057b
SSDEEP 786432:s3YMu8r7ULViftTFfTsB6BXGprNE4Q51n2Wt1WuvSBAe:attr7ActgpEP2W3AA
TLSH
T1AE6733EBD1EBD39888815AD87D4A01CB7884608EC9ED47392D8FEC1175D1C7E05CEAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77291079

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.?'6

Size

Virtual Size

49.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.$>b

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.NBc

Size

29.7MB

Virtual Size

29.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

aimwhere.dll

user32

kernel32

generic