credssp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
credssp.dll
Resource
win10v2004-20240508-en
General
-
Target
credssp.dll
-
Size
19KB
-
MD5
e64c78241626230b1963bc076a9057bf
-
SHA1
1ee741fc68d36053530d3a113b6156eb17eca437
-
SHA256
8e5279bc736ffa1cc878ced5f865c140ae2bd5b9cbc6cbbaf2bd23e58d6e354a
-
SHA512
01f43030fd8ce736f53b5eb89bd42ca86deea58a2778c95a09fdc524098518080e7c7f52fef0c8fb036dc6719378bd2ab2006eedf9310bea6699ef00dcae7654
-
SSDEEP
384:YN6nMmVMY6jzpGwdfooCh0J+QQAx93/9NZgvWDRWG:a6MmSGhhr2V3ZJ/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource credssp.dll
Files
-
credssp.dll.dll windows:10 windows x86 arch:x86
9b9cd3160c44fb25ed87c8b700bcc9dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_amsg_exit
_wcsicmp
free
malloc
_initterm
_XcptFilter
wcscpy_s
_except_handler4_common
wcsncpy_s
_wcsnicmp
memcpy
memmove
sspicli
DecryptMessage
QuerySecurityPackageInfoW
InitializeSecurityContextW
VerifySignature
FreeCredentialsHandle
AcquireCredentialsHandleW
QueryContextAttributesW
DeleteSecurityContext
ImpersonateSecurityContext
AcceptSecurityContext
EncryptMessage
MakeSignature
QuerySecurityContextToken
SetCredentialsAttributesW
FreeContextBuffer
ApplyControlToken
RevertSecurityContext
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ntasn1
ord37
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
InitSecurityInterfaceW
SpAcceptSecurityContext
SpAcquireCredentialsHandleW
SpAddCredentialsW
SpApplyControlToken
SpChangeAccountPasswordW
SpCompleteAuthToken
SpDecryptMessage
SpDeleteSecurityContext
SpEncryptMessage
SpEnumerateSecurityPackagesW
SpExportSecurityContext
SpFreeContextBuffer
SpFreeCredentialsHandle
SpImpersonateSecurityContext
SpImportSecurityContextW
SpInitializeSecurityContextW
SpMakeSignature
SpQueryContextAttributesW
SpQueryCredentialsAttributesW
SpQuerySecurityContextToken
SpQuerySecurityPackageInfoW
SpRevertSecurityContext
SpSetContextAttributesW
SpSetCredentialsAttributesW
SpVerifySignature
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ