rsa[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

rsa.dll
Size

740KB
MD5

3925637dae8797721f30976e688b84d8
SHA1

e260fc3f8646b605cf05684afca681dc74061efa
SHA256

17ddc339b14845bc9d67c5c3cd9a0e617387cc0569131ff3641035d82043effa
SHA512

7ae16443b752c88a7e9231120cc337bf4c7d05b67daa572771d0daed49e4ee7efec3ec4a64faf8799f69d01b6928d82d9d284d8ccc1410595dafd531fd17e880
SSDEEP

12288:K+1cFmBrQHSTbgEQyl9l7zoapUnyVK8vFn+hPrD2YOve2nfeDrE:sMES/3Qmn7Ma2Y9WDrE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rsa.dll

Files

rsa.dll
.dll windows:5 windows x64 arch:x64

22ee5a3e54f624bc62e9f4702475fdb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\jenkins_slave\workspace\N_MBAE_AeSdk\bin\x64\ReleaseNA\mbae-api-na.pdb

Imports

crypt32

CertComparePublicKeyInfo
CryptMsgOpenToDecode
CryptBinaryToStringW
CryptMsgGetParam
CryptMsgUpdate
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CertGetNameStringW
CryptQueryObject
CryptMsgClose

kernel32

LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
GetLogicalDriveStringsW
OpenProcess
GetExitCodeProcess
TerminateProcess
Process32FirstW
QueryDosDeviceW
Module32FirstW
Process32NextW
CreateToolhelp32Snapshot
Module32NextW
GetCurrentProcess
WaitForSingleObject
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
CreateThread
SetEvent
CreateRemoteThread
SetLastError
GetExitCodeThread
CreateEventW
WaitForMultipleObjects
GetSystemDirectoryW
SystemTimeToFileTime
SetFilePointerEx
GetSystemTimeAsFileTime
GetPrivateProfileStringW
FileTimeToSystemTime
SwitchToThread
WideCharToMultiByte
MultiByteToWideChar
GetVersion
SetThreadPriority
TerminateThread
ReleaseSemaphore
ReleaseMutex
DuplicateHandle
GetProcessHeap
CreatePipe
lstrcpyA
lstrcatA
lstrlenA
CreateMutexW
CreateSemaphoreW
IsBadReadPtr
VirtualProtectEx
ExitProcess
WriteProcessMemory
ResumeThread
lstrcpyW
lstrlenW
GetCurrentDirectoryW
VirtualProtect
VirtualQuery
VirtualAllocEx
VirtualFreeEx
VirtualQueryEx
GetCurrentThread
OpenThread
GetThreadContext
SetThreadContext
Thread32First
Thread32Next
VirtualAlloc
VirtualFree
GetOverlappedResult
ResetEvent
DeviceIoControl
CreateFileMappingA
CancelIo
OpenEventW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetFileType
HeapFree
HeapAlloc
GetFileSize
ReadProcessMemory
LoadLibraryW
FreeLibrary
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask
LocalAlloc
lstrcmpA
FindNextFileW
FindClose
FindFirstFileW
GetCurrentProcessId
DeleteFileW
OutputDebugStringA
GetCurrentThreadId
GetFileAttributesExW
GetModuleFileNameA
GetSystemInfo
LoadLibraryA
GetLocalTime
MoveFileW
GetLastError
GetModuleFileNameW
ReadFile
GetVersionExW
Sleep
GetLocaleInfoW
WriteFile
OutputDebugStringW
CreateDirectoryW
GetSystemDefaultUILanguage
GetFullPathNameW
LocalFree
CloseHandle
GetModuleHandleA
CreateFileMappingW
GetProcAddress
GetFileSizeEx
CreateFileW
GetFileAttributesW
UnmapViewOfFile
MapViewOfFile
GetTickCount
GetStdHandle
HeapSize
GetModuleHandleExW
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
GetCommandLineA
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
GetStringTypeW
EncodePointer
DecodePointer

user32

GetSystemMetrics
wsprintfW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CryptCreateHash
SetEntriesInAclW
CryptDestroyHash
CryptHashData
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
SetServiceObjectSecurity
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
RegDeleteValueA
GetKernelObjectSecurity
FreeSid
AllocateAndInitializeSid
GetTokenInformation
RegEnumKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CreateWellKnownSid
RegCreateKeyExW

shell32

CommandLineToArgvW
SHGetFolderPathW

psapi

GetModuleInformation
GetModuleBaseNameW
GetProcessImageFileNameW
EnumProcessModulesEx

netapi32

NetWkstaGetInfo
NetApiBufferFree

wintrust

CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext

shlwapi

StrStrIW

Exports

Exports

MbaeAddProtectedApp
MbaeClearExclusions
MbaeDSI
MbaeDelProtectedApp
MbaeGetBrowserCacheFiles
MbaeGetProtectedApps
MbaeGetState
MbaeInitialize
MbaeModProtectedApp
MbaeSetConfig
MbaeSetExclusions
MbaeSetLoggingStatus
MbaeShutdown
MbaeStart
home

Sections

.text
Size: 409KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22ee5a3e54f624bc62e9f4702475fdb4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

advapi32

shell32

psapi

netapi32

wintrust

shlwapi

Exports

Exports

Sections

.text Size: 409KB - Virtual size: 409KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 44KB - Virtual size: 58KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 70KB - Virtual size: 70KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 409KB - Virtual size: 409KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 44KB - Virtual size: 58KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 70KB - Virtual size: 70KB

.reloc
Size: 3KB - Virtual size: 3KB