oyylqpp3ia.dll
First submission 2023-09-14 10:52:03
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1093.5 KB (1119744 bytes) |
| Compile time: | 2023-09-11 18:15:16 |
| MD5: | 45f4c6ea59bc7a8c2d20098698104940 |
| SHA1: | 08b4a0c8d7824a0dbd89680a70f3029355cfafea |
| SHA256: | 2aae03be2893a2d742528bbd737b4195d84f6d3663e9eeff8c646c53675d7838 |
| Import Hash : | 660e4ba65070c42e55f04efddf5f7d78 |
| Sections 7 | .text .rdata .data .pdata .gfids .rsrc .reloc |
| Directories 4 | import export resource relocation |
| Virus Total: | 16/67 VT report date: 2023-09-14 08:39:57 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://116.203.112.62/oyylqpp3ia.dll  |
116.203.112.62 |
2023-09-14 10:52:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xe80b | 59904 | 3d8e61774c945a7111e7a882111428333ebf44fb | 35624140f9f86e6e45576d7a803900dd | |
| .rdata | 0x10000 | 0x419b6 | 268800 | 0449bbe1d77e2148071b8ab122f7e98a2d886517 | 8dd1f6587a684641dfe0d3076c96ee3d | |
| .data | 0x52000 | 0xbfc88 | 781312 | ae258df4865f2e3abf4f7e99260556471bcb7d49 | a96ee2ea79638a1e37557e2042013166 | |
| .pdata | 0x112000 | 0xe4c | 4096 | a1dbcfafd8f9621dd85fa703361e7a420ef196c6 | 253cd349c6e587a7e07354aee8edb0bf | |
| .gfids | 0x113000 | 0x94 | 512 | b8db57937efb465ad950b3b78b8d34c1f47b6d1f | 9598f4c961d5e93e2c06fe3b3cb0e8e9 | |
| .rsrc | 0x114000 | 0x728 | 2048 | 0c55dd4c0998fed3b6019e177e9106fb279b7af0 | cbc8a329d23b29cf1007bd2a03f54f84 | |
| .reloc | 0x115000 | 0x61c | 2048 | a5275ad46cbaa99b9c42a3add3e1c0bc978cac5c | 331f8941a7b3234693ac92e5c855b334 |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114320 | 646 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1145a8 | 381 | |
| None | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114120 | 196 |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| mscoree.dll |
| utpcxre663tc32.dll |
| KERNEL32.dll |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| DllRegisterServer | 0x18000f210 |
| Name | Latest seen | MD5 |
|---|---|---|
| jyi6mm2w2g.dll | 2023-09-14 10:54:03 | 7d2156efddf126dfb4c466da06f15e11 |
| 6sev8udq1h.dll | 2023-09-14 10:55:02 | 3a96a42f6d6334a36d2ea26abb0a2c95 |
| i9ien8gksg.dll | 2023-09-14 10:56:02 | fcbb53724b1df93a5d1fc45bb55b9069 |
| hk1c9y18em.dll | 2023-09-14 10:57:03 | a6ac1a8bb63362ed7515f2ca02fb52be |