summon[.]dll | Triage™

General

Target
summon.dll
Size 445KB
Sample261030-2bkk7agy4j
SHA256 64be9e4a576ef657a1940a8e753bd38e1be731e99c14477414bdee0a0345ebfb
MD5 15371a085d87c1c7e6af7931d402f868
SHA1 fefc1bb99b0a668e9531400f906feaf66554bd78
SHA512 98620ed85037a5615f0271b07cff55a0a4fbc9e135015770350b2160c76d463405b94e799768c05d79ecd496e924ab3710852cc49d16196e7cfe45d8063af10b
SSDEEP 6144:zk0EBtaccH9fh9LUDdQTzTxuJgpfuENG78vgy/myQ5G/W2IhOQvduq:zk0Ev/cdwdQTzNueluJ8vg6myb/
TLSH
T150A47C17E28444A8E06BC07483575B36BB36B8854721BAFF07E4A6352F6AFE05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
summon.dll

File Explorer

summon.dll

.dll 445KB

summon.dll

IMPHASH 387a8f46cd5af53cfdbf277d178efac8
SHA256 64be9e4a576ef657a1940a8e753bd38e1be731e99c14477414bdee0a0345ebfb
MD5 15371a085d87c1c7e6af7931d402f868
SHA1 fefc1bb99b0a668e9531400f906feaf66554bd78
SHA512 98620ed85037a5615f0271b07cff55a0a4fbc9e135015770350b2160c76d463405b94e799768c05d79ecd496e924ab3710852cc49d16196e7cfe45d8063af10b
SSDEEP 6144:zk0EBtaccH9fh9LUDdQTzTxuJgpfuENG78vgy/myQ5G/W2IhOQvduq:zk0Ev/cdwdQTzNueluJ8vg6myb/
TLSH
T150A47C17E28444A8E06BC07483575B36BB36B8854721BAFF07E4A6352F6AFE05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

balls

Minor OS version

0

Major OS version

6

Entry point

251264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

summon.pdb

kernel32

HeapAlloc RtlVirtualUnwind ReleaseMutex CreateMutexA FormatMessageW GetCurrentProcessId WaitForSingleObjectEx FreeLibrary LoadLibraryExW GetModuleHandleExW InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx InterlockedFlushSList EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection GetCurrentThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader ExitProcess TerminateProcess FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect HeapSize RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentThreadId SetThreadStackGuarantee SwitchToThread HeapReAlloc HeapFree GetProcessHeap DeleteCriticalSection Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW CreateThread LoadLibraryExA GetProcAddress LoadLibraryA GetModuleHandleW GetModuleHandleA SetLastError GetModuleFileNameW GetLastError CloseHandle GetStringTypeW GetFileType LCMapStringW SetFilePointerEx WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetSystemTimeAsFileTime SetStdHandle QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle WideCharToMultiByte GetFullPathNameW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx GetCurrentDirectoryW lstrlenW

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

oleaut32

SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

Name

.text

Size

309KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

summon.dll

kernel32

ntdll

oleaut32

api-ms-win-core-synch-l1-2-0

generic