64dll[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
64dll.dll.exe
Size 169KB
Sample261102-vm1m8ady5p
SHA256 fbab7699a3ed3b40ae464e6c9a487be078dc0cb38e5681ffa6ffeb6ba49d1b26
MD5 fb8b292c7d0316d2470484483c5e4f67
SHA1 bc6387792aae8f2e64eb24487ee660797fb68b5d
SHA512 6b6289e37c830d58beb6890af60469b83b32014be2af1235d8e3a059e1bc07d835f3aa26abc800920b7665ec240854853a7c0e457a140133675eb8ac9505bb84
SSDEEP 3072:VcWpaIa30OlFbTF2oK5Ci1+epVlSSXbjXmaRjdv21ngniiFa:V9s30UTNWCi1n/XvBza
TLSH
T1BA044A4376A400FAE467D279C9935A06E3B334560775A7CF526087BA1F233E2BE3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64dll.dll.exe

File Explorer

64dll.dll.exe

.dll 169KB

64dll.dll.exe

IMPHASH 82cb1376c33d24223d2097dc4e88c038
SHA256 fbab7699a3ed3b40ae464e6c9a487be078dc0cb38e5681ffa6ffeb6ba49d1b26
MD5 fb8b292c7d0316d2470484483c5e4f67
SHA1 bc6387792aae8f2e64eb24487ee660797fb68b5d
SHA512 6b6289e37c830d58beb6890af60469b83b32014be2af1235d8e3a059e1bc07d835f3aa26abc800920b7665ec240854853a7c0e457a140133675eb8ac9505bb84
SSDEEP 3072:VcWpaIa30OlFbTF2oK5Ci1+epVlSSXbjXmaRjdv21ngniiFa:V9s30UTNWCi1n/XvBza
TLSH
T1BA044A4376A400FAE467D279C9935A06E3B334560775A7CF526087BA1F233E2BE3A351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

WSAWaitForMultipleEvents WSAEnumNetworkEvents socket WSACreateEvent WSACloseEvent recv connect bind WSACleanup WSAResetEvent WSAStartup getaddrinfo freeaddrinfo getsockname getpeername WSASetLastError WSAStringToAddressA shutdown closesocket send setsockopt WSAIoctl inet_ntop htons ntohs WSAEventSelect WSAGetLastError

user32

PeekMessageA DispatchMessageA MsgWaitForMultipleObjects GetLastInputInfo TranslateMessage

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

kernel32

FlsSetValue ExitThread UnmapViewOfFile SwitchToThread CreateFileMappingA MapViewOfFileEx GetFileSize CreateFileA FlushFileBuffers CreateFileW HeapSize WriteConsoleW SetStdHandle LoadLibraryW GetStringTypeW LCMapStringW RtlPcToFileHeader RaiseException GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount ExitProcess DisableThreadLibraryCalls MultiByteToWideChar SetLastError CreateMutexW GetLastError CloseHandle GetTickCount Sleep lstrcpyA lstrcmpA lstrlenA WaitForSingleObject CreateThread GetModuleHandleA GetProcAddress WideCharToMultiByte lstrcpynA FreeLibrary HeapAlloc HeapFree GetProcessHeap IsBadReadPtr InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventA LoadLibraryA ResetEvent HeapReAlloc DecodePointer EncodePointer GetCurrentThreadId ReadFile GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsFree FlsAlloc HeapSetInformation GetVersion HeapCreate HeapDestroy WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleW

shlwapi

StrChrA

winmm

timeGetTime