credssp[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

credssp.dll
Size

17KB
MD5

b78422e6c87ecc236b89a81b0b1c4fcb
SHA1

6c547c697bbd19018e9da1080b96e44e7015f553
SHA256

042c39dc2d465928f43b16fc339a0e74a1a30930eb282e3eb03d6b93267c8410
SHA512

08dee2df0871b5434acd504f7a554c4b1621c7ead399c86a33ba9beb74058a558a51550c2000fe2da1fa123b7c21ebbd55b5a35e85dbe414d7ce0393b90e2054
SSDEEP

384:nsLeoE5m/3huABdepfL0vz5vQXo2HCWpIA7Yk1uXlz3W9RW:n8vhuAB4pz0vz2sc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
credssp.dll

Files

credssp.dll
.dll windows:6 windows x86 arch:x86

5be2aacfb1cd4cbdeab98b0067ac724e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

credssp.pdb

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
wcscpy_s
memmove
_wcsicmp
memcpy
wcsncpy_s
_wcsnicmp

sspicli

FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
ApplyControlToken
ImpersonateSecurityContext
RevertSecurityContext
MakeSignature
VerifySignature
QuerySecurityContextToken
EncryptMessage
DecryptMessage
QuerySecurityPackageInfoW
DeleteSecurityContext
AcquireCredentialsHandleW
FreeCredentialsHandle
QueryContextAttributesW

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetLastError
GetProcAddress
LocalAlloc
LocalFree
DelayLoadFailureHook
DisableThreadLibraryCalls

Exports

Exports

InitSecurityInterfaceW
SpAcceptSecurityContext
SpAcquireCredentialsHandleW
SpAddCredentialsW
SpApplyControlToken
SpChangeAccountPasswordW
SpCompleteAuthToken
SpDecryptMessage
SpDeleteSecurityContext
SpEncryptMessage
SpEnumerateSecurityPackagesW
SpExportSecurityContext
SpFreeContextBuffer
SpFreeCredentialsHandle
SpImpersonateSecurityContext
SpImportSecurityContextW
SpInitializeSecurityContextW
SpMakeSignature
SpQueryContextAttributesW
SpQueryCredentialsAttributesW
SpQuerySecurityContextToken
SpQuerySecurityPackageInfoW
SpRevertSecurityContext
SpSetContextAttributesW
SpSetCredentialsAttributesW
SpVerifySignature

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5be2aacfb1cd4cbdeab98b0067ac724e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

sspicli

kernel32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1008B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 672B

.text
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1008B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 672B