mn[.]dll | Triage™

General

Target
mn.dll
Size 14.8MB
Sample261107-wf7cvsfe68
SHA256 1084b02f92d51a10112e0ac3056658fffe87c5cd6d587324cc09061df15fcc4e
MD5 bc3baf28605c6992202357332c4ce599
SHA1 5e1cd481a2ad8bff58cac81c267c18a810309bd6
SHA512 41c5a2b6942a08f73e386875a4fa91504d3d366b5f3e63900a812eb5a79053249048b14f583fc8bc210d5d36d9518197724c32529b08869763bd9362c2d87edb
SSDEEP 393216:fzqf0ChzGCweHb3hINH+oAGVPQ9nwMKFll+R:/WjN7RLq9Indcl
TLSH
T127F60132B0116072F4AA49764ADF6F9E51BA0A350360D8EB6B943CCA5771DFA2731F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mn.dll

File Explorer

mn.dll

.dll 14.8MB

mn.dll

IMPHASH f5daf45d52ec6c9d18786ce27c8f44af
SHA256 1084b02f92d51a10112e0ac3056658fffe87c5cd6d587324cc09061df15fcc4e
MD5 bc3baf28605c6992202357332c4ce599
SHA1 5e1cd481a2ad8bff58cac81c267c18a810309bd6
SHA512 41c5a2b6942a08f73e386875a4fa91504d3d366b5f3e63900a812eb5a79053249048b14f583fc8bc210d5d36d9518197724c32529b08869763bd9362c2d87edb
SSDEEP 393216:fzqf0ChzGCweHb3hINH+oAGVPQ9nwMKFll+R:/WjN7RLq9Indcl
TLSH
T127F60132B0116072F4AA49764ADF6F9E51BA0A350360D8EB6B943CCA5771DFA2731F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

inet_ntop WSASetLastError ntohs

kernel32

WriteConsoleW HeapSize CloseHandle CreateThread VirtualQuery DisableThreadLibraryCalls ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualProtect GetModuleHandleW GetProcAddress LoadLibraryW GetCurrentProcessId GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW AddVectoredExceptionHandler RemoveVectoredExceptionHandler Sleep GetCurrentProcess GetCurrentThreadId OpenThread ExitThread SuspendThread ResumeThread GetThreadContext SetThreadContext ReadProcessMemory CreateToolhelp32Snapshot Thread32First Thread32Next WaitForSingleObject CreateRemoteThread TerminateThread GetExitCodeThread GetProcessId FlushInstructionCache OpenProcess VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleHandleExW LoadLibraryExW LoadLibraryA MultiByteToWideChar Module32FirstW Module32NextW HeapCreate HeapFree GetLastError HeapReAlloc HeapAlloc VirtualFree VirtualAlloc SetStdHandle LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandleEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlUnwind InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14.6MB

Virtual Size

14.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mn.dll

ws2_32

kernel32

generic