StepCLI[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
StepCLI.dll
Size 33.5MB
Sample261027-xtl5hsft7z
SHA256 9049d06ba59fe901fad907a92306b95e4efbfb1f2782be6026b35eaf12789fde
MD5 11bfa4bd93e8d2c77ffe63c83f517340
SHA1 83bbeecb32434d73a266ba295322414f6f880325
SHA512 8160fe67282d9c7438ce0a4f4f68f8252fd374e7a1d3d4a1f05fc03a5b723c4d180d5e7dd820cd8af65b73a4ae661bc27ede296b2554e3a082061df6168938cc
SSDEEP 786432:UW1pEJGb2xDljAXxSLhOvhgPacWCaJRbTY74/lOU:LoIbWD5AX80hgPaRb87497
TLSH
T1FA7712C678E592ECC752C639D28A17FAE38635968E76941F7FC644023630C86CDB2D36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StepCLI.dll

File Explorer

StepCLI.dll

.dll 33.5MB

StepCLI.dll

IMPHASH 17d06aa9c5a2321af7ae183b094bfd2b
SHA256 9049d06ba59fe901fad907a92306b95e4efbfb1f2782be6026b35eaf12789fde
MD5 11bfa4bd93e8d2c77ffe63c83f517340
SHA1 83bbeecb32434d73a266ba295322414f6f880325
SHA512 8160fe67282d9c7438ce0a4f4f68f8252fd374e7a1d3d4a1f05fc03a5b723c4d180d5e7dd820cd8af65b73a4ae661bc27ede296b2554e3a082061df6168938cc
SSDEEP 786432:UW1pEJGb2xDljAXxSLhOvhgPacWCaJRbTY74/lOU:LoIbWD5AX80hgPaRb87497
TLSH
T1FA7712C678E592ECC752C639D28A17FAE38635968E76941F7FC644023630C86CDB2D36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47835269

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

opengl32

glColor4f

wininet

InternetReadFile

winmm

PlaySoundA

ws2_32

ioctlsocket

kernel32

GetFileInformationByHandle

user32

LoadCursorW

comdlg32

GetOpenFileNameA

advapi32

RegOpenKeyExA

shell32

SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal

imm32

ImmReleaseContext

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

msvcp140_atomic_wait

__std_atomic_wait_direct

gdiplus

GdipBitmapUnlockBits

api-ms-win-core-winrt-l1-1-0

RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

bcrypt

BCryptDecrypt

vcruntime140

__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-stdio-l1-1-0

fwrite

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

fmod

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Name

.text

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.BL+

Size

Virtual Size

21.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.9%J

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.%;<

Size

33.5MB

Virtual Size

33.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

233B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

StepCLI.dll

opengl32

wininet

winmm

ws2_32

kernel32

user32

comdlg32

advapi32

shell32

ole32

imm32

msvcp140

msvcp140_atomic_wait

gdiplus

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic