kerberos.pdb
Static task
static1
1 signatures
General
-
Target
dll_1
-
Size
878KB
-
MD5
53b0679a8e7400c22d44e902fc72270e
-
SHA1
b28280cdaddfdc070e59ecf40b33c688f58bebd0
-
SHA256
a7504addd9879ff171030b24a35c7454a39a997021a6056f4d58314529e07268
-
SHA512
13203c1ada3fa69c00bbecf90017808bae8b4c119a9386d0b31f658f3ba2fabd4b050de366c6eaade7be40604b331ddfab0fa2cd964b10d6aeed5f9dde6744e0
-
SSDEEP
24576:UBFyfjqYXC497wT59pk1Y5+ER+Uq57sNW4pnrVwswE:U7yLqYCisTxk1YUn4pn/w
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dll_1
Files
-
dll_1.dll windows:5 windows x64 arch:x64
3deb0ec3489831c68610df64d6264fcb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
FreeSid
AllocateAndInitializeSid
LookupAccountSidW
OpenThreadToken
CredUnmarshalCredentialW
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegConnectRegistryW
EqualSid
GetLengthSid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
CryptGetHashParam
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
GetTraceLoggerHandle
RegisterTraceGuidsW
SystemFunction006
RegNotifyChangeKeyValue
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
TraceEvent
CredFree
SystemFunction007
cryptdll
MD5Update
CDLocateCheckSum
CDGenerateRandomBits
CDLocateCSystem
CDBuildIntegrityVect
MD5Final
CDFindCommonCSystemWithKey
MD5Init
kernel32
lstrlenW
DelayLoadFailureHook
__C_specific_handler
DeleteTimerQueueTimer
CreateTimerQueueTimer
CompareStringA
lstrcmpiA
GetSystemDefaultLCID
lstrlenA
GetCurrentThread
WaitForSingleObject
DeleteCriticalSection
OpenFileMappingW
GetModuleFileNameA
GetSystemInfo
GetProfileStringA
CreateFileMappingW
GetLocalTime
EnterCriticalSection
VirtualAlloc
CreateFileW
LeaveCriticalSection
LoadLibraryW
InitializeCriticalSection
WriteFile
MapViewOfFileEx
UnmapViewOfFile
CreateFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetACP
WideCharToMultiByte
UnregisterWait
RegisterWaitForSingleObjectEx
SetEvent
OpenEventW
FreeLibrary
GetProcAddress
LoadLibraryA
GetComputerNameW
GetComputerNameExW
Sleep
GetLastError
MultiByteToWideChar
lstrcpyW
GetModuleFileNameW
GetModuleHandleW
FormatMessageW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CreateEventW
DisableThreadLibraryCalls
LocalAlloc
GetCurrentProcessId
LocalFree
lstrcmpW
CloseHandle
GetSystemTimeAsFileTime
msasn1
ASN1BERDecZeroCharString
ASN1BEREncS32
ASN1BEREncEndOfContents
ASN1BEREncSX
ASN1BEREncOctetString
ASN1DecSetError
ASN1BERDecEndOfContents
ASN1charstring_free
ASN1BERDecCharString
ASN1Free
ASN1BEREncU32
ASN1BEREncBool
ASN1BEREncExplicitTag
ASN1BERDecBool
ASN1BERDecOpenType2
ASN1BEREncBitString
ASN1bitstring_free
ASN1BERDecBitString
ASN1DecAlloc
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1BERDecS32Val
ASN1ztcharstring_free
ASN1BERDecU32Val
ASN1BERDecSXVal
ASN1octetstring_free
ASN1BEREncOpenType
ASN1BERDecSkip
ASN1BEREncObjectIdentifier
ASN1BERDecGeneralizedTime
ASN1BERDecObjectIdentifier
ASN1objectidentifier_free
ASN1CEREncGeneralizedTime
ASN1BERDecNotEndOfContents
ASN1BERDecExplicitTag
ASN1BEREncCharString
ASN1_CreateModule
ASN1_CloseDecoder
ASN1intx_free
ASN1_CreateEncoder
ASN1_FreeEncoded
ASN1_Decode
ASN1_FreeDecoded
ASN1_CreateDecoder
ASN1_CloseEncoder
ASN1intx_setuint32
ASN1_Encode
ASN1intx2int32
ASN1intx2uint32
ASN1intxisuint32
msvcrt
_resetstkoflw
memset
_ultoa
qsort
wcstoul
wcsspn
memcmp
memcpy
_wcsnicmp
strrchr
_vsnprintf
_strcmpi
_snprintf
strchr
_snwprintf
_strnicmp
malloc
free
_initterm
_wcsicmp
sscanf
sprintf
_stricmp
wcsrchr
swprintf
ntdll
RtlConvertSharedToExclusive
RtlCompareMemory
NtSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlEqualSid
RtlLengthSid
NtOpenProcessToken
NtQueryInformationToken
RtlDeleteResource
RtlInitializeResource
NtClose
RtlAcquireResourceExclusive
NtOpenThreadToken
RtlDeleteCriticalSection
RtlReleaseResource
RtlAcquireResourceShared
RtlFreeUnicodeString
RtlInitUnicodeString
RtlCreateTimerQueue
RtlCreateTimer
RtlDeregisterWait
RtlRegisterWait
NtQuerySystemInformation
RtlIntegerToUnicodeString
RtlInitializeCriticalSection
RtlEraseUnicodeString
RtlRunDecodeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlLeaveCriticalSection
NtAllocateLocallyUniqueId
RtlUpcaseUnicodeString
NtCreateEvent
NtOpenEvent
NtWaitForSingleObject
RtlSystemTimeToLocalTime
RtlDowncaseUnicodeString
VerSetConditionMask
RtlVerifyVersionInfo
NtQuerySystemTime
RtlInitializeSid
RtlSubAuthoritySid
RtlCopySid
RtlCopyUnicodeString
RtlPrefixUnicodeString
RtlEqualDomainName
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlAllocateAndInitializeSid
RtlFreeSid
RtlAppendUnicodeStringToString
RtlLengthRequiredSid
RtlValidSid
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlSubAuthorityCountSid
RtlDeleteTimerQueueEx
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlNtStatusToDosError
RtlUniform
RtlOemStringToUnicodeString
DbgPrint
RtlFreeHeap
RtlAllocateHeap
RtlImageNtHeader
RtlEnterCriticalSection
NtDuplicateObject
RtlCompareUnicodeString
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
NtOpenProcess
RtlCopyLuid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteTimerQueue
secur32
CredMarshalTargetInfo
CredUnmarshalTargetInfo
LsaGetLogonSessionData
LsaFreeReturnBuffer
FreeContextBuffer
user32
wsprintfW
CharLowerBuffW
Exports
Exports
CfGetPlatformInfo
KerbDomainChangeCallback
KerbFree
TfGetPlatformInfo
OfGetPlatformIn
WfGetPlatformIn
SpInitialize
VfGetPlatformI
SpLsaModeInitialize
SpUserModeInitialize
Sections
.text Size: 591KB - Virtual size: 590KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ