C:\ADE\aime_884264\oracle\rdbms\bin\orawsec19.pdb
Static task
static1
Behavioral task
behavioral1
Sample
orawsec19.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
orawsec19.dll
Resource
win10v2004-20240226-en
General
-
Target
orawsec19.zip
-
Size
111KB
-
MD5
ead0dae29d407aa0b6d5b2ab10ee98c4
-
SHA1
3a9e56ecf1305257501ba4cabb7ebf3033a031aa
-
SHA256
b0eb77e8cb8a2c511b9e2094cbb1a2d7fc555acd4a3b9aa891bac7c8dc8e71e0
-
SHA512
ea213b96b7e8d58568fbb530792473c598e20fb10e665832b80454cc317192784dd7b0e1baf70af486455039113ecaa3c695cd03956330f1e4f73ee13f0c163b
-
SSDEEP
3072:bl/nbVE44gTQCZpi7wGqXeJ9Jsv/WWeHAgIZ:b9bV9UCZpdXehGreHQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/orawsec19.dll
Files
-
orawsec19.zip.zip
-
orawsec19.dll.dll windows:6 windows x86 arch:x86
a2b17907a8a4db1f95f090c2e7995cb9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TerminateProcess
ReadFile
GetEnvironmentVariableA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetComputerNameW
LocalAlloc
GetVolumePathNameA
lstrcpyA
FindFirstFileA
GetFileAttributesA
lstrcatA
QueryPerformanceCounter
WideCharToMultiByte
GetCurrentProcess
FormatMessageA
LocalFree
GetUserDefaultLangID
GetModuleHandleA
GetModuleFileNameA
CreateFileA
LoadLibraryExA
CloseHandle
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
GetVersionExW
lstrcatW
GetVolumeInformationW
GetLastError
FindFirstFileW
GetFileAttributesW
FindNextFileW
FindClose
GetSystemTimeAsFileTime
GetVolumeInformationA
netapi32
NetValidatePasswordPolicyFree
NetUserDel
NetUserAdd
NetLocalGroupEnum
NetValidatePasswordPolicy
NetLocalGroupDel
NetLocalGroupAdd
NetLocalGroupGetInfo
NetApiBufferFree
NetUserGetLocalGroups
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetLocalGroupAddMembers
advapi32
BuildExplicitAccessWithNameA
RegSetValueExW
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegFlushKey
RegConnectRegistryA
RegOpenKeyExA
RegQueryValueExA
CopySid
LsaEnumerateAccountsWithUserRight
LsaFreeMemory
LsaRemoveAccountRights
LsaNtStatusToWinError
LsaAddAccountRights
LsaOpenPolicy
LsaClose
LogonUserW
CreateWellKnownSid
ChangeServiceConfigW
EnumServicesStatusExW
QueryServiceConfigW
DeleteService
LookupAccountNameW
QueryServiceObjectSecurity
SetServiceObjectSecurity
OpenServiceW
ChangeServiceConfig2W
IsWellKnownSid
OpenSCManagerW
ConvertStringSidToSidA
LookupAccountSidW
RegQueryValueExW
CreateServiceW
CloseServiceHandle
SetTokenInformation
GetKernelObjectSecurity
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetKernelObjectSecurity
RegQueryInfoKeyA
RegEnumKeyExW
GetSecurityInfo
GetNamedSecurityInfoW
RegConnectRegistryW
RegOpenKeyExW
RegCloseKey
SetNamedSecurityInfoW
ConvertStringSidToSidW
OpenProcessToken
GetTokenInformation
SetEntriesInAclA
AllocateAndInitializeSid
GetLengthSid
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAce
InitializeAcl
IsValidSid
EqualSid
GetAce
GetAclInformation
GetSecurityDescriptorDacl
GetFileSecurityW
FreeSid
vcruntime140
memset
__std_type_info_destroy_list
strstr
_except_handler3
wcsrchr
_except_handler4_common
wcschr
memcpy
api-ms-win-crt-heap-l1-1-0
free
malloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
strncpy
towupper
strcat_s
strcpy_s
wcscmp
wcsncpy
_wcsnicmp
wcslen
wcscpy_s
_stricmp
wcscpy
wcscat
api-ms-win-crt-stdio-l1-1-0
fopen
fflush
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vswprintf
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
api-ms-win-crt-time-l1-1-0
_strdate
_strtime
api-ms-win-crt-convert-l1-1-0
atoi
mbtowc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initterm_e
_initterm
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
authz
AuthzInitializeContextFromSid
AuthzInitializeResourceManager
AuthzAccessCheck
AuthzFreeContext
AuthzFreeResourceManager
Exports
Exports
setPermissions
setPermissions2
sswseAddACEOnDefaultDACLForSvcUser
sswseAddACEOnKernelObjectForUserOrGroup
sswseAddACLOnObjectForUser
sswseAddACLOnObjectForUser2
sswseAddAceToACL
sswseAddFullPermForSVCSIDSGroup
sswseAddUserToGroup
sswseChangeServicesPwdForUser
sswseChangeServicesPwdInOHForUser
sswseCheckACLOnObjectForUser
sswseCheckACLsOnObject
sswseCheckACLsOnReg
sswseCheckAccessMask
sswseCheckOSGroup
sswseCheckUserExists
sswseCheckUserInGroup
sswseCheckUserPrivileges
sswseCheckValidUser
sswseConvertSIDToUname
sswseConvertUnameToSID
sswseCopyPermissionsFromParentToChildren
sswseCreateOSGroup
sswseCreateOracleSVCUser
sswseCreateSVCEventRegEntry
sswseCreateService
sswseDeleteOSGroup
sswseDeleteOracleSVCUser
sswseDeleteSVCEventRegEntry
sswseDeleteSVCSidsFromORAHomeGroups
sswseDeleteService
sswseFillErrMsg
sswseFreeArrayofStrings
sswseFreeMemory
sswseGetAllServicesForUser
sswseGetAllServicesInOHForUser
sswseGetBuiltinAccName
sswseGetOHomeNameFromVAGroupName
sswseGetOracleHomeKey
sswseGetOracleHomeName
sswseGetOracleHomeType
sswseGetOracleHomeTypeForOHPath
sswseGetOwnerSIDForCurrentProcess
sswseGetPredefKey
sswseGetServiceSID
sswseGetServiceSidName
sswseGetSvcUserForService
sswseGetUnameForOhome
sswseGetUnameForOhomePath
sswseGetVAGroupnameForOHomename
sswseGrantPrivilegesToUser
sswseIsAdministrator
sswseIsGroupManagedSVCAccount
sswseIsManagedSVCAccount
sswseIsNameBuiltinAcc
sswseIsOSVistaOrAbove
sswseIsOSWin7OrAbove
sswseIsOSWin8OrAbove
sswseIsOSWinDC
sswseIsOhomeTypeValid
sswseIsPasswordValid
sswseIsSVCUserGMSA
sswseIsSVCUserMSA
sswseIsSVCUserPasswordRequired
sswseIsSvcRunningAsLocalSystem
sswseIsSvcUserLocalService
sswseIsSvcUserLocalSystem
sswseIsSvcUserVirtualAccount
sswseIsUserDomainUser
sswseMigrateDBServiceSidsForDowngrade
sswseMigrateDBServiceSidsForUpgrade
sswseRemoveUserFromGroup
sswseRevokeACLOnObjectForUser
sswseRevokePrivilegesFromUser
sswseSetACLOnObjectForUser
sswseSetACLOnObjectForUser2
sswseSetOracleHomeType
sswseSetUnameForOhome
sswseTraceOff
sswseTraceOn
sswseUpdateService
Sections
.text Size: 233KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ