xzlib0[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xzlib0.dll
Size 11.7MB
Sample261113-deb68afv8k
SHA256 8e8f691da0907f2bdcc641d394c2fceef399b9731a5ac3556de9c77d53b52078
MD5 0999c040dfac74a9b6b05bcf12224348
SHA1 5bdcec4daeaf9baee63ae31ad069b0ab36dfc3da
SHA512 072f43619e964810ce3d3e47b90ea5a7bc0268392450aaee485a4c38f2282a11045da087bbfa328324dd0559f690cb45cf7ea6a3f6ac2223a8cc11fe78d22358
SSDEEP 196608:EcBcxvo1l4+RwlWzZKva1gTLvxJoY+Z/TuiQvVuxDvGG:KQPwlWsyOXvDoY+NTgVux/
TLSH
T12BC623D50AA192B5C093061061CB8399B0C1B69D51FC5D2E3DD56C422A2CDEFA6CEFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xzlib0.dll

File Explorer

xzlib0.dll

.dll 11.7MB

xzlib0.dll

IMPHASH 39c961bc399bbff2ebcea235bab2f32b
SHA256 8e8f691da0907f2bdcc641d394c2fceef399b9731a5ac3556de9c77d53b52078
MD5 0999c040dfac74a9b6b05bcf12224348
SHA1 5bdcec4daeaf9baee63ae31ad069b0ab36dfc3da
SHA512 072f43619e964810ce3d3e47b90ea5a7bc0268392450aaee485a4c38f2282a11045da087bbfa328324dd0559f690cb45cf7ea6a3f6ac2223a8cc11fe78d22358
SSDEEP 196608:EcBcxvo1l4+RwlWzZKva1gTLvxJoY+Z/TuiQvVuxDvGG:KQPwlWsyOXvDoY+NTgVux/
TLSH
T12BC623D50AA192B5C093061061CB8399B0C1B69D51FC5D2E3DD56C422A2CDEFA6CEFFB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13499989

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aspr0

Size

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.aspr1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspr2

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

xzlib0.dll

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic