auth[.]aspx | Triage™

General

Target
auth.aspx
Size 2.5MB
Sample220630-2ydfdsdff5
SHA256 e66c2a09074fa94390262c8b925988e7d9a085edcc97cad79e2ccc9c0e862567
MD5 64a2807bc1385ee99c892012ed0a62bf
SHA1 1d21c43b582ca6ad77714c05976fe5827f028bd0
SHA512 78352c8643206849726ff7240d9a80faedc76f9586943dd8cdb649ff62af658a849258783fec50157b5f7118a0442ab538a475886d44a2993b2aa7be1b5b46a1
SSDEEP 24576:mqT2k/bnfBTdVrDEAI4OB0BamaA0OsvmEvLn7m0ot1:DT28bnftdxDBI10HawQmUOb
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

auth.aspx

.dll 2.5MB

auth.aspx

IMPHASH 9a7916591612073af6b6746771444f57
SHA256 e66c2a09074fa94390262c8b925988e7d9a085edcc97cad79e2ccc9c0e862567
MD5 64a2807bc1385ee99c892012ed0a62bf
SHA1 1d21c43b582ca6ad77714c05976fe5827f028bd0
SHA512 78352c8643206849726ff7240d9a80faedc76f9586943dd8cdb649ff62af658a849258783fec50157b5f7118a0442ab538a475886d44a2993b2aa7be1b5b46a1
SSDEEP 24576:mqT2k/bnfBTdVrDEAI4OB0BamaA0OsvmEvLn7m0ot1:DT28bnftdxDBI10HawQmUOb
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Minor OS version

Major OS version

Entry point

24779

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Beep WriteFile CloseHandle GetModuleHandleA GetFileAttributesA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId VirtualAllocEx GetModuleHandleW lstrcmpA lstrlenA IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError SetLastError TerminateProcess IsProcessorFeaturePresent HeapAlloc ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress HeapFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LoadLibraryExW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc WriteConsoleW CreateFileW SetFilePointerEx GetStartupInfoW QueryPerformanceCounter InitializeSListHead RaiseException RtlUnwind InterlockedFlushSList EncodePointer GetModuleFileNameW FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle GetFileType SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer

shlwapi

StrToIntA ord155

Name

.text

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.relocs

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

365KB

Virtual Size

365KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

auth.aspx

kernel32

shlwapi