urlauthz[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

urlauthz.dll
Size

23KB
MD5

a47a365dd2b318a05a608c7866e3af19
SHA1

852ec009c6cafee2b4f8088ef6e26f76e52f6714
SHA256

4aa798e5a0e0a8e649206ec14bf038cbc9ca90940637c41750a96a98076f89c6
SHA512

9e173072de2b784dab56fe97d931fc992b7a4da4f528eb381a8e8ba91b2dd4bb31cc0c9fd5830a3e03c02d5abaa508907ad3a0a2771eb700e8e9614698691770
SSDEEP

384:a7iR31L3kpyh/wL+wIzyk8MfrEErGoARNumlH+rBxR2gn59ZOXuHFWxqm:a7iR31LR/FzPCcWH+bR2CfZO+HYq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
urlauthz.dll

Files

urlauthz.dll
.dll windows:10 windows x64 arch:x64

36f6aad3bc8d5dd37447ac1661f260ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

urlauthz.pdb

Imports

msvcrt

_wcsicmp
free
malloc
_callnewh
_XcptFilter
_amsg_exit
__C_specific_handler
_initterm
memcpy
memset

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
DebugBreak

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-security-base-l1-2-0

CheckTokenMembership
GetTokenInformation
EqualSid

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

iisutil

??0STRU@@QEAA@XZ
??0STRA@@QEAA@XZ
?WriteLock@CReaderWriterLock3@@QEAAXXZ
PuDbgPrintError
?Resize@BUFFER@@QEAA_NK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?CopyWTruncate@STRA@@QEAAJPEBGK@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
IISGetPlatformType
PuDeleteDebugPrintsObject
??1STRA@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??1STRU@@QEAA@XZ
??0BUFFER@@QEAA@XZ

Exports

Exports

RegisterModule

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36f6aad3bc8d5dd37447ac1661f260ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

iisutil

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 828B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 512B - Virtual size: 160B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 828B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 512B - Virtual size: 160B