cred64.dll

First submission 2024-02-11 02:21:01 Last sumbission 2024-02-11 02:21:02

File details

File type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 1255.5 KB (1285632 bytes)
Compile time: 2024-02-10 09:20:15
MD5: ba8c5dc5ec763007a4af9cb06bef78ef
SHA1: a50aaf51e7d5998a4cb7a4218f463b06fd005b5e
SHA256: 26b468da8e91ddbb807a9f8c95e2bd3f01510cb9438d7ae6134d108900e06b88
Import Hash : 3eb70f83441fc8632e81bd6eb89f424d
Sections 7 .text .rdata .data .pdata _RDATA .rsrc .reloc
Directories 5 import export resource debug relocation
Virus Total:

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://5.42.64.44/BlsSwk93eX/Plugins/cred64.dll VirusTotal Report 5.42.64.44 VirusTotal Report 2024-02-11 02:21:02

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0xfbef8 1032192 cb26184936a5684efe7f13bc5948b8d2f187c095 1ae11355009adb59ef21dbd2e4c1fecb
.rdata 0xfd000 0x2cde2 183808 6648b2df5fad89fec63ae22304138b3c085d3579 f61a52b6d3cef73701a406fbc465465e
.data 0x12a000 0xbb4c 17408 47a8e09010ed26ceb5914b328a4315a37347ef35 02bd6deb3afde973ccfa6f7be4b2468d
.pdata 0x136000 0xad28 44544 9fed2f75f906a8594145647903a6b0df9c5af120 a752966eb97c2d784e038894a37a13ef
_RDATA 0x141000 0x94 512 2d5ae0778d2ca9620bb763074e3551a0ae51c087 a5995913394631ab4f6ef283137b5c9d
.rsrc 0x142000 0xf8 512 6f2aee814106277dae3a8e6b3254dde0bfde7fc7 193fc41b7ab2ce83170d116dba1ce3ac
.reloc 0x143000 0x15f4 5632 ce84cdd3862451ee4c82d22aa290a14e260840bf 6b255962cbf9942cc97cd613f7352d10

PE Resources 1

Name Language Sublanguage Offset Size Data
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x142060 145

Anti debug functions 10

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
OutputDebugStringA
OutputDebugStringW
Process32FirstW
Process32NextW
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

XML
FileZilla\sitemanager.xml
Psi\profiles\default\accounts.xml
\.purple\accounts.xml
.purple\accounts.xml
Library
mscoree.dll
KERNEL32.dll
bcrypt.dll
ADVAPI32.dll
SHELL32.dll
WININET.dll
Crypt32.dll
STEALERDLL.dll
nss3.dll

Strings analysis - Possible IPs found 1

3.8.7.4

Import functions

PE Exports 2 suspicious

Function Address
Main 0x1800c11f0
Save 0x180005cf0
Name Latest seen MD5
cred64.dll 2023-12-03 09:31:02 a17a5ab2d131cd9eefcece4f1d22e531
cred64.dll 2023-12-05 20:11:03 1afaa1fcda6635e17dce5b5bf27f3c79
cred64.dll 2023-12-08 11:13:02 b5cdfc4ca11aa7705c605fd93538a310
cred64.dll 2024-01-17 19:52:02 9e18426a541bc9f54ef80cba50ac6090
cred64.dll 2024-02-01 07:04:03 a1fbee549a00971cece863265a7403aa
cred64.dll 2024-02-02 07:41:03 f35b671fda2603ec30ace10946f11a90
cred64.dll 2024-02-05 02:05:02 92fbdfccf6a63acef2743631d16652a7