Edit tour

Windows Analysis Report
OnlineFix64.dll

Overview

General Information

Sample name:	OnlineFix64.dll
Analysis ID:	1667705
MD5:	485fa45f1886c44a1f2dbf7b8c132971
SHA1:	3833e8c37c6181ff148e0ca19f28145f9b80a8a9
SHA256:	54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found direct / indirect Syscall (likely to bypass EDR)

Creates a process in suspended mode (likely to inject code)

Entry point lies outside standard sections

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 8004 cmdline: loaddll64.exe "C:\Users\user\Desktop\OnlineFix64.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8056 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 8080 cmdline: rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8064 cmdline: rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamMiniDumpInit MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7324 cmdline: rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSendMiniDump MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7464 cmdline: rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSetAppID MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Cryptography
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: OnlineFix64.dll	ReversingLabs: Detection: 41%
Source: OnlineFix64.dll	Virustotal: Detection: 48%			Perma Link

Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_08558b97-a

Source: OnlineFix64.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: loaddll64.exe, 00000000.00000002.1397555129.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346715215.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251876594.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365808011.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416062030.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: loaddll64.exe, 00000000.00000002.1397555129.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346715215.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251876594.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365808011.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416062030.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html.
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://api.steampowered.com/&l=&appid=?key=ISteamUserStats/GetSchemaForGame/v2/Failed
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steam/apps/
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steam/apps/Statsachievedtimestampdesc10CheaterYour
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://online-fix.me
Source: loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://online-fix.me?

Source: classification engine

Classification label: mal52.evad.winDLL@12/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamMiniDumpInit

Source: OnlineFix64.dll	ReversingLabs: Detection: 41%
Source: OnlineFix64.dll	Virustotal: Detection: 48%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\OnlineFix64.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamMiniDumpInit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSendMiniDump
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSetAppID
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamMiniDumpInit	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSendMiniDump	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSetAppID	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: OnlineFix64.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: OnlineFix64.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: OnlineFix64.dll

Static file information: File size 11944448 > 1048576

Source: OnlineFix64.dll

Static PE information: Raw size of .of2 is bigger than: 0x100000 < 0xb63600

Source: OnlineFix64.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: initial sample

Static PE information: section where entry point is pointing to: .of2

Source: OnlineFix64.dll	Static PE information: section name: .of0
Source: OnlineFix64.dll	Static PE information: section name: .of1
Source: OnlineFix64.dll	Static PE information: section name: .of2

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9CF91392	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9CB52901	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9C9BE0E2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9C8E4721	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9C8A7708	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9CA16F31	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Archive Collected Data	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OnlineFix64.dll	42%	ReversingLabs	Win64.Trojan.Generic
OnlineFix64.dll	49%	Virustotal		Browse

Name	Source	Malicious	Reputation
https://api.steampowered.com/	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	false	high
https://online-fix.me	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	false	high
https://cdn.akamai.steamstatic.com/steam/apps/	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	false	high
https://cdn.akamai.steamstatic.com/steam/apps/Statsachievedtimestampdesc10CheaterYour	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	false	high
https://online-fix.me?	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	false	high
http://www.openssl.org/support/faq.html.	loaddll64.exe, 00000000.00000002.1397555129.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346715215.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251876594.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365808011.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416062030.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp	false	high
https://curl.haxx.se/docs/http-cookies.html	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1B3000.00000002.00000001.01000000.00000003.sdmp	false	high
https://api.steampowered.com/&l=&appid=?key=ISteamUserStats/GetSchemaForGame/v2/Failed	loaddll64.exe, 00000000.00000002.1397395394.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346641415.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251792910.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365476341.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416001112.00007FFC9C1E3000.00000002.00000001.01000000.00000003.sdmp	false	high
http://www.openssl.org/support/faq.html	loaddll64.exe, 00000000.00000002.1397555129.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1346715215.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1251876594.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1365808011.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.1416062030.00007FFC9C251000.00000004.00000001.01000000.00000003.sdmp	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1667705
Start date and time:	2025-04-17 18:01:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OnlineFix64.dll
Detection:	MAL
Classification:	mal52.evad.winDLL@12/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 131.253.33.254, 20.12.23.50
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.786676201550379
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	OnlineFix64.dll
File size:	11'944'448 bytes
MD5:	485fa45f1886c44a1f2dbf7b8c132971
SHA1:	3833e8c37c6181ff148e0ca19f28145f9b80a8a9
SHA256:	54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944
SHA512:	e1e77f0f710abfa92261305d893597093177250d57630ce459bd657c09fc05773b1fbbf0387c1ca854650e52a8071a0c152b9011cdb197d97149990943e75e5b
SSDEEP:	196608:NlMHThZSFtSb3v19yOO10Xx9OYRNJsV1aUIu:AHTTSFt8N/O+u
TLSH:	31C622ED55D062B4D1D38640B18B539931C1A14D81FD0D193ECB2D412FAACBF6A8EAFB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Y.g.........." ...+.............K.......................................0A...........`................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180904b03
Entrypoint Section:	.of2
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67DD5995 [Fri Mar 21 12:20:37 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	10c1b70987e42d05f256c6e82924ec7e

Entrypoint Preview

Instruction
call 00007FC0B91B5DB3h
jo 00007FC0B8B280DEh
cmp ebp, ebx
bsr ecx, ebx
sub dh, al
into
daa
xchg dword ptr [eax-39h], ecx
inc esp
and al, 00h
in eax, 73h
mov byte ptr [edi], cl
call 00007FC0B934939Ah
retf
aas
hlt
mov ebp, 5E61A344h
push esi
pop es
pop ds
add byte ptr [edx+19h], ch
jmp 00007FC0B8D187B3h
dec edx
leave
dec ecx
into
pop es
pop ds
add byte ptr [ebx+076E69C1h], al
pop ds
add bl, ah
and dword ptr [esi], ebx
test byte ptr [edi], 0000001Fh
add byte ptr [ebx-4Fh], ah
out dx, eax
int3
mov eax, dword ptr [6CA96B33h]
sar byte ptr [eax], cl
test eax, 00000000h
cld
lodsb
salc
retf FA05h
push eax
cld
mov cl, 09h
jp 00007FC0B8B28086h
inc edi
or eax, 05FDCAE9h
test byte ptr [edi-02358ED3h], al
add eax, A1ED5750h
retf 05FDh
mov bl, 7Dh
sub edx, ecx
std
add eax, 74CDE55Ch
sbb al, byte ptr [edx+44B37C76h]
and al, byte ptr [eax-31h]
test dword ptr [edi-1FBCFFEFh], 118F7FC8h
add byte ptr [edx-70106768h], cl
adc dword ptr [eax], eax
and eax, dword ptr [eax]
mov bh, CFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xfa9f98	0x5fb	.of2
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfabc60	0x8c	.of2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1411000	0x298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x13f9c10	0x16980	.of2
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1412000	0x11c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xfa4e08	0x28	.of2
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x13f9ad0	0x140	.of2
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8ac000	0x60	.of1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c1900	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1c3000	0x9d248	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x261000	0x4e9c0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2b0000	0x16788	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.of0	0x2c7000	0x5e4a65	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.of1	0x8ac000	0x98	0x200	de5379d172ecaca37e4772d87fb3880d	False	0.087890625	data	0.33663902068200274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.of2	0x8ad000	0xb63590	0xb63600	cfdf1599b7dae5d3b76b46de58ff4611	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1411000	0x298	0x400	d738e2865db806d2e191758b771453d8	False	0.3291015625	data	2.3333434004877316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1412000	0x11c	0x200	84a9767bb0a3e9e6d330c0593ae1fa2e	False	0.42578125	data	2.7275311200931984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1411058	0x240	data	Russian	Russia	0.5173611111111112

Imports

DLL	Import
KERNEL32.dll	GetModuleHandleA
USER32.dll	GetUserObjectInformationW
SHELL32.dll	SHGetSpecialFolderPathA
WS2_32.dll	ioctlsocket
WLDAP32.dll
ADVAPI32.dll	RegisterEventSourceW

Exports

Name	Ordinal	Address
Breakpad_SteamMiniDumpInit	1	0x18005f2f0
Breakpad_SteamSendMiniDump	2	0x18005f300
Breakpad_SteamSetAppID	3	0x18005f310
Breakpad_SteamSetSteamID	4	0x18005f320
Breakpad_SteamWriteMiniDumpSetComment	5	0x18005f330
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId	6	0x18005f340
CreateInterface	7	0x18005ef30
OnlineFix	8	0x18005ed80
ShellExecuteA	9	0x18005ed90
ShellExecuteW	10	0x18005edf0
Steam_BConnected	11	0x18005f350
Steam_BGetCallback	12	0x18005ee50
Steam_BLoggedOn	13	0x18005f360
Steam_BReleaseSteamPipe	14	0x18005f370
Steam_ConnectToGlobalUser	15	0x18005f380
Steam_CreateGlobalUser	16	0x18005f390
Steam_CreateLocalUser	17	0x18005f3a0
Steam_CreateSteamPipe	18	0x18005f3b0
Steam_FreeLastCallback	19	0x18005eef0
Steam_GSBLoggedOn	20	0x18005f3d0
Steam_GSBSecure	21	0x18005f3e0
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient	22	0x18005f3f0
Steam_GSGetSteamID	23	0x18005f400
Steam_GSLogOff	24	0x18005f410
Steam_GSLogOn	25	0x18005f420
Steam_GSRemoveUserConnect	26	0x18005f430
Steam_GSSendSteam2UserConnect	27	0x18005f440
Steam_GSSendSteam3UserConnect	28	0x18005f450
Steam_GSSendUserDisconnect	29	0x18005f460
Steam_GSSendUserStatusResponse	30	0x18005f470
Steam_GSSetServerType	31	0x18005f480
Steam_GSSetSpawnCount	32	0x18005f490
Steam_GSUpdateStatus	33	0x18005f4a0
Steam_GetAPICallResult	34	0x18005eea0
Steam_GetGSHandle	35	0x18005f3c0
Steam_InitiateGameConnection	36	0x18005f4b0
Steam_IsKnownInterface	37	0x18005f4c0
Steam_LogOff	38	0x18005f4d0
Steam_LogOn	39	0x18005f4e0
Steam_NotifyMissingInterface	40	0x18005f4f0
Steam_ReleaseThreadLocalMemory	41	0x18005f500
Steam_ReleaseUser	42	0x18005f510
Steam_SetLocalIPBinding	43	0x18005f520
Steam_TerminateGameConnection	44	0x18005f530

Version Infos

Description	Data
CompanyName	Online-Fix.Me
FileDescription	Online-Fix Steamclient
FileVersion	1.3.3.2
LegalCopyright	Copyright (C) 2021-2025, 0xdeadc0de
ProductVersion	1.3.3.2
Translation	0x0007 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

• loaddll64.exe
• conhost.exe
• cmd.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

Memory Usage

• loaddll64.exe
• conhost.exe
• cmd.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	12:02:12
Start date:	17/04/2025
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\OnlineFix64.dll"
Imagebase:	0x7ff707db0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:02:12
Start date:	17/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:02:12
Start date:	17/04/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1
Imagebase:	0x7ff74fc90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:02:12
Start date:	17/04/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamMiniDumpInit
Imagebase:	0x7ff796b90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:02:12
Start date:	17/04/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\OnlineFix64.dll",#1
Imagebase:	0x7ff796b90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:02:15
Start date:	17/04/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSendMiniDump
Imagebase:	0x7ff796b90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:02:18
Start date:	17/04/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\OnlineFix64.dll,Breakpad_SteamSetAppID
Imagebase:	0x7ff796b90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OnlineFix64.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll64.exePID: 8004, Parent PID: 3964

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Windows Analysis Report
OnlineFix64.dll