Patched_offline_experimental_v2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Patched_offline_experimental_v2.dll
Size 1.4MB
Sample261107-rc975ayxf1
SHA256 93e6f94eaa982917a4d463f716dacad051495b73f7edf313f27b00050ed6af11
MD5 627c2bd96f9f48102e3d0962e53584ce
SHA1 b84b6459b104cd11b2b4b517e2d916bb82b452b8
SHA512 e02e1d4e4235592a460fbe92dea3ce42b2128a05eca1d830021960a95c5587352fab14b618ce3905ccc3b32c079d11e6fcbff1a2080fe36b1c4dcc1903cfd21e
SSDEEP 24576:GGFWG7um4bnKWOc2KTL7Q4ai/ZjMZzUqi/x3nIedn1mq9t+BB:G7PvLjgz+/x3nd1mq9tCB
TLSH
T1EC65CF45B253C171D54C16B0BA7DFBAFB52C6C702F2485D7B3D41EA998E12D32AF2A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Patched_offline_experimental_v2.dll

File Explorer

Patched_offline_experimental_v2.dll

.dll 1.4MB

Patched_offline_experimental_v2.dll

IMPHASH 506a4e7cc9c12cb043600dee9ca91fae
SHA256 93e6f94eaa982917a4d463f716dacad051495b73f7edf313f27b00050ed6af11
MD5 627c2bd96f9f48102e3d0962e53584ce
SHA1 b84b6459b104cd11b2b4b517e2d916bb82b452b8
SHA512 e02e1d4e4235592a460fbe92dea3ce42b2128a05eca1d830021960a95c5587352fab14b618ce3905ccc3b32c079d11e6fcbff1a2080fe36b1c4dcc1903cfd21e
SSDEEP 24576:GGFWG7um4bnKWOc2KTL7Q4ai/ZjMZzUqi/x3nIedn1mq9t+BB:G7PvLjgz+/x3nd1mq9tCB
TLSH
T1EC65CF45B253C171D54C16B0BA7DFBAFB52C6C702F2485D7B3D41EA998E12D32AF2A02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

879152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winhttp

WinHttpSetOption WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect

advapi32

RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegQueryValueExA RegCloseKey RegDeleteKeyA GetUserNameA CredDeleteW

kernel32

GetCurrentProcess GetEnvironmentVariableA GetModuleHandleA GetLastError K32GetModuleInformation CreateDirectoryA VirtualQuery GetModuleFileNameA VirtualProtect TerminateProcess GetVolumeInformationA FreeLibraryAndExitThread GetCurrentThreadId CreateToolhelp32Snapshot MultiByteToWideChar Sleep Process32NextW DisableThreadLibraryCalls GetCurrentThread GetSystemDirectoryA LoadLibraryA DeleteFileA Process32FirstW CloseHandle CreateThread Module32FirstW GetThreadContext GetProcAddress GetCurrentProcessId WideCharToMultiByte Module32NextW QueryPerformanceCounter OpenThread GetComputerNameA CheckRemoteDebuggerPresent GetFileAttributesA GetLocalTime FindFirstFileA FindNextFileA FindClose FindFirstFileW VirtualAlloc HeapCreate HeapFree Thread32Next Thread32First SuspendThread ResumeThread HeapReAlloc HeapAlloc HeapDestroy FlushInstructionCache SetThreadContext OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary GetLocaleInfoEx GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI FindFirstFileExW FindNextFileW InitializeSListHead GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent GetSystemTimeAsFileTime FormatMessageA VirtualFree LocalFree

user32

GetKeyState GetWindowTextA LoadCursorA ScreenToClient GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetKeyNameTextA EnumWindows GetClassNameA IsWindowVisible EnumDisplayDevicesA GetWindowThreadProcessId GetCursorPos SetCursorPos ShowCursor SetWindowLongW ClipCursor MapVirtualKeyA GetAsyncKeyState

shell32

ShellExecuteW

msvcp140

?_Incref@facet@locale@std@@UAEXXZ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ __crtLCMapStringA ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ??0facet@locale@std@@IAE@I@Z ??1facet@locale@std@@MAE@XZ ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z _Mtx_lock _Mtx_unlock _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPBDH@Z _Xtime_get_ticks ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?good@ios_base@std@@QBE_NXZ _Strxfrm ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

bcrypt

BCryptHashData BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptGenRandom BCryptCreateHash BCryptOpenAlgorithmProvider

winmm

timeGetTime

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140

_except_handler4_common __current_exception __current_exception_context _CxxThrowException __std_type_info_destroy_list memmove memcpy memchr __RTtypeid __std_type_info_compare strchr _purecall __std_terminate __std_exception_copy __std_exception_destroy memset __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free realloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfscanf __stdio_common_vsprintf_s fread __acrt_iob_func fflush _wfopen __stdio_common_vfprintf __stdio_common_vsscanf fseek ftell fopen __stdio_common_vsprintf fwrite fclose

api-ms-win-crt-convert-l1-1-0

atoll strtoul strtol atof

api-ms-win-crt-string-l1-1-0

isalnum strncpy strncmp isspace isxdigit tolower _wcsnicmp toupper _stricmp isblank

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _gmtime64_s _time64 _ctime64_s

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_cos_precise _fdclass ldexp _libm_sse2_acos_precise _CIfmod ceil _libm_sse2_tan_precise floor _CIatan2

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _crt_atexit _cexit _initterm _initterm_e _initialize_onexit_table abort _initialize_narrow_environment terminate _seh_filter_dll _register_onexit_function _configure_narrow_argv system

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func