Report - nlhtml.dll

Gen1 Generic Malware Malicious Library Malicious Packer PE File DLL PE64 DllRegisterServer dll
ScreenShot
Created 2024.10.14 11:08 Machine s1_win7_x6403_us
Filename nlhtml.dll
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
AI Score Not founds Behavior Score
0.6
ZERO API
VT API (file)
md5 5a968a83780406c060335be361e0ea99
sha256 f41032bfb7ef0b2a228c46b30b40b28e9cbd7dc19879b1996e1d71f2a5782eec
ssdeep 3072:fhcc2FnM4s0Kq6JiOu5jDTRy7P+uzPQjGkS0S09AUFXcvbxp:ZcW4pKm5rRy7PRLQj3SGVFsvF
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (8cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsDLL (no description) binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure