03998837722[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
03998837722.dll.exe
Size 237KB
Sample230817-qaxnksbb4v
SHA256 09aa4597e560065585d8392a3a44dbd30ad25f7cbb33a0541b088d8897e68546
MD5 baaf70daeae15a3ff21b192a321a9e42
SHA1 7ed68c50054912104aeb3d3cf75eee9b1ac8f8d0
SHA512 660600b2398d7b2f5f5fc7c1895fc4bb924bc39564130fc7d3c1ac42cc5413bcc951f21b1b0567cd63bbf55baee7211053fd4bad37b5120022550cdaf12999fe
SSDEEP 6144:12ZjwB1CNMtkXqbRPa4PsXriauVpCb0VazK8KC:12ZjcCNMVp5Ebpu/CIVazK8KC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03998837722.dll.exe

File Explorer

03998837722.dll.exe

.dll 237KB

03998837722.dll.exe

IMPHASH a56f115ee5ef2625bd949acaeec66b76
SHA256 09aa4597e560065585d8392a3a44dbd30ad25f7cbb33a0541b088d8897e68546
MD5 baaf70daeae15a3ff21b192a321a9e42
SHA1 7ed68c50054912104aeb3d3cf75eee9b1ac8f8d0
SHA512 660600b2398d7b2f5f5fc7c1895fc4bb924bc39564130fc7d3c1ac42cc5413bcc951f21b1b0567cd63bbf55baee7211053fd4bad37b5120022550cdaf12999fe
SSDEEP 6144:12ZjwB1CNMtkXqbRPa4PsXriauVpCb0VazK8KC:12ZjcCNMVp5Ebpu/CIVazK8KC
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

147024

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

t_gss_c_attr_local_login_user t_gss_c_attr_stream_sizes_oid_desc t_gss_c_cred_certificate_oid_desc t_gss_c_cred_password_oid_desc t_gss_c_ma_auth_init_anon_oid_desc t_gss_c_ma_auth_init_init_oid_desc t_gss_c_ma_auth_init_oid_desc t_gss_c_ma_auth_targ_anon_oid_desc t_gss_c_ma_auth_targ_init_oid_desc t_gss_c_ma_auth_targ_oid_desc t_gss_c_ma_cbindings_oid_desc t_gss_c_ma_compress_oid_desc t_gss_c_ma_conf_prot_oid_desc t_gss_c_ma_ctx_trans_oid_desc t_gss_c_ma_deleg_cred_oid_desc t_gss_c_ma_deprecated_oid_desc t_gss_c_ma_integ_prot_oid_desc t_gss_c_ma_itok_framed_oid_desc t_gss_c_ma_mech_composite_oid_desc t_gss_c_ma_mech_concrete_oid_desc t_gss_c_ma_mech_description_oid_desc t_gss_c_ma_mech_glue_oid_desc t_gss_c_ma_mech_name_oid_desc t_gss_c_ma_mech_nego_oid_desc t_gss_c_ma_mech_pseudo_oid_desc t_gss_c_ma_mic_oid_desc t_gss_c_ma_not_dflt_mech_oid_desc t_gss_c_ma_not_mech_oid_desc t_gss_c_ma_oos_det_oid_desc t_gss_c_ma_pfs_oid_desc t_gss_c_ma_prot_ready_oid_desc t_gss_c_ma_replay_det_oid_desc t_gss_c_ma_sasl_mech_name_oid_desc t_gss_c_ma_wrap_oid_desc t_gss_c_nt_anonymous_oid_desc t_gss_c_nt_dn_oid_desc t_gss_c_nt_export_name_oid_desc t_gss_c_nt_hostbased_service_oid_desc t_gss_c_nt_hostbased_service_x_oid_desc t_gss_c_nt_machine_uid_name_oid_desc t_gss_c_nt_ntlm_oid_desc t_gss_c_nt_string_uid_name_oid_desc t_gss_c_nt_user_name_oid_desc t_gss_c_ntlm_avguest_oid_desc t_gss_c_ntlm_force_v1_oid_desc t_gss_c_ntlm_session_key_oid_desc t_gss_c_ntlm_v1_oid_desc t_gss_c_ntlm_v2_oid_desc t_gss_c_peer_has_updated_spnego_oid_desc t_gss_krb5_ccache_name_x_oid_desc t_gss_krb5_compat_des3_mic_x_oid_desc t_gss_krb5_copy_ccache_x_oid_desc t_gss_krb5_cred_no_ci_flags_x_oid_desc t_gss_krb5_export_lucid_context_v1_x_oid_desc t_gss_krb5_export_lucid_context_x_oid_desc t_gss_krb5_extract_authz_data_from_sec_context_x_oid_desc t_gss_krb5_get_acceptor_subkey_x_oid_desc t_gss_krb5_get_authtime_x_oid_desc t_gss_krb5_get_initiator_subkey_x_oid_desc t_gss_krb5_get_service_keyblock_x_oid_desc t_gss_krb5_get_subkey_x_oid_desc t_gss_krb5_get_time_offset_x_oid_desc t_gss_krb5_get_tkt_flags_x_oid_desc t_gss_krb5_import_cred_x_oid_desc t_gss_krb5_mechanism_oid_desc t_gss_krb5_nt_principal_name_oid_desc t_gss_krb5_nt_principal_name_referral_oid_desc t_gss_krb5_plugin_register_x_oid_desc t_gss_krb5_register_acceptor_identity_x_oid_desc t_gss_krb5_send_to_kdc_x_oid_desc t_gss_krb5_set_allowable_enctypes_x_oid_desc t_gss_krb5_set_default_realm_x_oid_desc t_gss_krb5_set_dns_canonicalize_x_oid_desc t_gss_krb5_set_time_offset_x_oid_desc t_gss_ntlm_get_session_key_x_oid_desc t_gss_ntlm_mechanism_oid_desc t_gss_sasl_digest_md5_mechanism_oid_desc t_gss_spnego_mechanism_oid_desc tgssapi_wrap_size_cfx tgsskrb5cfx_wrap_length_cfx tss_accept_sec_context tss_acquire_cred tss_acquire_cred_with_password tss_add_buffer_set_member tss_add_cred tss_add_cred_with_password tss_add_oid_set_member tss_authorize_localname tss_canonicalize_name tss_compare_name tss_context_query_attributes tss_context_time tss_create_empty_buffer_set tss_create_empty_oid_set tss_decapsulate_token tss_delete_name_attribute tss_delete_sec_context tss_display_mech_attr tss_display_name tss_display_name_ext tss_display_status tss_duplicate_name tss_duplicate_oid tss_encapsulate_token tss_export_cred tss_export_name tss_export_name_composite tss_export_sec_context tss_get_mic tss_get_name_attribute tss_import_cred tss_import_name tss_import_sec_context tss_indicate_mechs tss_indicate_mechs_by_attrs tss_init_sec_context tss_inquire_attrs_for_mech tss_inquire_context tss_inquire_cred tss_inquire_cred_by_mech tss_inquire_cred_by_oid tss_inquire_mech_for_saslname tss_inquire_mechs_for_name tss_inquire_name tss_inquire_names_for_mech tss_inquire_saslname_for_mech tss_inquire_sec_context_by_oid tss_krb5_ccache_name tss_krb5_copy_ccache tss_krb5_export_lucid_sec_context tss_krb5_free_lucid_sec_context tss_krb5_get_tkt_flags tss_krb5_import_cred tss_krb5_set_allowable_enctypes tss_localname tss_mg_collect_error tss_mo_get tss_mo_list tss_mo_name tss_mo_set tss_name_to_oid tss_oid_equal tss_oid_to_name tss_oid_to_str tss_pname_to_uid tss_process_context_token tss_pseudo_random tss_release_buffer tss_release_buffer_set tss_release_cred tss_release_iov_buffer tss_release_name tss_release_oid tss_release_oid_set tss_seal tss_set_cred_option tss_set_name_attribute tss_set_sec_context_option tss_sign tss_store_cred tss_test_oid_set_member tss_unseal tss_unwrap tss_unwrap_aead tss_unwrap_iov tss_userok tss_verify tss_verify_mic tss_wrap tss_wrap_aead tss_wrap_iov tss_wrap_iov_length tss_wrap_size_limit tsskrb5_extract_authtime_from_sec_context tsskrb5_extract_authz_data_from_sec_context tsskrb5_extract_service_keyblock tsskrb5_get_initiator_subkey tsskrb5_get_subkey tsskrb5_get_time_offset tsskrb5_register_acceptor_identity tsskrb5_set_default_realm tsskrb5_set_dns_canonicalize tsskrb5_set_send_to_kdc tsskrb5_set_time_offset vcab

Name

.text

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

03998837722.dll.exe

kernel32