payload[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
payload.dll
Size 1.0MB
Sample261102-wpjm6ad14n
SHA256 8599d04d2da3aac7bb23cf3bf52f1ee3f03a97ccdeb7cb086ae5c6575d7d8b1a
MD5 306a36ee4b90169dd84aef5fada7b0f9
SHA1 215f443c02f39d66f7c82a4f44eedd083ddcae26
SHA512 03912cc4d07e03f6e73bfef0ec9cc5c180a33b0d56b09804ffeedf4f70ef99c3467b97ad4803f739450dc0c1e61cd45cdf227bf15db1b2ac91c4878570a3fe25
SSDEEP 24576:1UWhqwjmpBJHvcK4eFAw9R5OE7RnBx+CqGrQK:aWhqwjmpBFvcK4eFAw9PnBxBqG
TLSH
T1A2355B37A5E801BEC116F1F8B3974D13E3B1F4D003286AE716A055696E17BEC4E7A293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
payload.dll

File Explorer

payload.dll

.dll 1.0MB

payload.dll

IMPHASH 2beb7fe0b38435c3a808e1854a71d204
SHA256 8599d04d2da3aac7bb23cf3bf52f1ee3f03a97ccdeb7cb086ae5c6575d7d8b1a
MD5 306a36ee4b90169dd84aef5fada7b0f9
SHA1 215f443c02f39d66f7c82a4f44eedd083ddcae26
SHA512 03912cc4d07e03f6e73bfef0ec9cc5c180a33b0d56b09804ffeedf4f70ef99c3467b97ad4803f739450dc0c1e61cd45cdf227bf15db1b2ac91c4878570a3fe25
SSDEEP 24576:1UWhqwjmpBJHvcK4eFAw9R5OE7RnBx+CqGrQK:aWhqwjmpBFvcK4eFAw9PnBxBqG
TLSH
T1A2355B37A5E801BEC116F1F8B3974D13E3B1F4D003286AE716A055696E17BEC4E7A293
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleA GetTempPathA DisableThreadLibraryCalls DeleteFileA GetSystemTimeAsFileTime GetCurrentProcessId WakeAllConditionVariable GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Thrd_detach ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_unlock _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memset memmove memcpy memcmp _CxxThrowException __C_specific_handler strchr _purecall __std_exception_copy __std_exception_destroy __std_terminate memchr __std_type_info_destroy_list

api-ms-win-crt-convert-l1-1-0

atoi strtod strtoll strtoull strtoul

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e _seh_filter_dll _beginthreadex terminate _errno _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf _fseeki64 fread fsetpos ungetc setvbuf fgetpos fopen_s fwrite fgetc __stdio_common_vsprintf_s _get_stream_buffer_pointers fclose fflush fputc __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-string-l1-1-0

ispunct isxdigit isalpha isupper isgraph toupper strpbrk strncmp strlen strcmp isdigit strncat strcspn strspn islower isspace iscntrl tolower strncpy isalnum

api-ms-win-crt-math-l1-1-0

atan asin acos ceil tanh round ldexp pow ceilf sin _dsign sinh sqrt cos sqrtf cosh exp tan floor log frexp modf log10 floorf atan2 fmod log2

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh malloc

api-ms-win-crt-time-l1-1-0

_gmtime64_s _localtime64_s strftime clock _difftime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file