Edit tour
Windows
Analysis Report
libcef.dll
Overview
General Information
| Sample name: | libcef.dll |
| Analysis ID: | 1365074 |
| MD5: | 5e66c360265a177475b9f73a334f9629 |
| SHA1: | d2c7594fea0a6d2810611523239a61e3d0736b33 |
| SHA256: | 0d0879633e7bd7be9e0de26afc32856fb34f944b2ae378589b5eb33c9795ca39 |
| Infos: | |
 | |
Detection
| Score: | 5 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 60% |
Signatures
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Installs a raw input device (often for capturing keystrokes)
PE file contains more sections than normal
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
Analysis Advice
| Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior |
| Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook |
- System is w10x64
loaddll32.exe (PID: 7280 cmdline: loaddll32. exe "C:\Us ers\user\D esktop\lib cef.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618) 
conhost.exe (PID: 7288 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7332 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\lib cef.dll",# 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) 
rundll32.exe (PID: 7356 cmdline: rundll32.e xe "C:\Use rs\user\De sktop\libc ef.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7348 cmdline:
rundll32.e xe C:\User s\user\Des ktop\libce f.dll,GetH andleVerif ier MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7416 cmdline:
rundll32.e xe C:\User s\user\Des ktop\libce f.dll,GetM ainTargetS ervices MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7456 cmdline:
rundll32.e xe C:\User s\user\Des ktop\libce f.dll,IsSa ndboxedPro cess MD5: 889B99C52A60DD49227C5E485A016679)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
- • Compliance
- • Networking
- • Key, Mouse, Clipboard, Microphone and Screen Capturing
- • System Summary
- • Data Obfuscation
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | String found in binary or memory: | ||