aadauthhelper[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

aadauthhelper.dll
Size

334KB
MD5

06903fbf5f6aeddc57ccf816f8731578
SHA1

9f3a3086aa58acf384ff78a1ca662d78d5c821fb
SHA256

013e21fc8d42cd168d9a96705d3e4cdcaea72a520ebd8fd0e69b841251714f68
SHA512

d22785684829803dcd5cb7a9df3b0b9633fae79ac3a53f5390c4baa9d445f9b19576f1fccd4a6e95dd6426887177a3f82b10ccad196aa19c8f696ceadbf4b550
SSDEEP

6144:+g2HAv+umh7DZZxmttSJU0kKh5BjSaf2a/2EBtK0UR7idLrDa3LHvYLmyDO:+g2ghmSEK83a7QPO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aadauthhelper.dll

Files

aadauthhelper.dll
.dll windows:10 windows x86 arch:x86

a1f1be5194ac4b3bd4282e048fb51322

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AADAuthHelper.pdb

Imports

msvcrt

memcpy
_ftol2_sse
_ftol2
_CxxThrowException
_unlock
_lock
isdigit
strtol
isxdigit
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
free
malloc
??_V@YAXPAX@Z
memmove
_except_handler4_common
realloc
??1type_info@@UAE@XZ
_onexit
__CxxFrameHandler3
__dllonexit
memcmp
_purecall
memcpy_s
memmove_s
iswspace
wcscpy_s
_wcsicmp
_vscwprintf
vswprintf_s
_vsnwprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_beginthread
_endthreadex
_beginthreadex
wcschr
_time64
_wtoi
wcsncmp
_wcslwr_s
wcsspn
wcscspn
wcsstr
calloc
wcsrchr
wcspbrk
_vsnprintf
swprintf_s
_mbsinc
wcsnlen
_errno
_wcserror
wcsncpy_s
_snwprintf_s
?what@exception@@UBEPBDXZ
_wcslwr
_wcsnicmp
_wtof
isalpha
memset

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptAcquireContextW
CryptGenRandom

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
SetThreadStackGuarantee

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

ntdll

RtlGetPersistedStateLocation
RtlGetVersion
RtlNtStatusToDosError
RtlImageNtHeader
RtlFreeHeap
RtlInitString
RtlPublishWnfStateData
RtlAllocateHeap
NtQueryWnfStateData

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
SizeofResource
GetProcAddress
FindResourceExW
LockResource
LoadResource
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

wkscli

NetGetJoinInformation

api-ms-win-security-lsalookup-l1-1-0

LookupAccountNameLocalW

netutils

NetApiBufferFree

api-ms-win-core-registry-l1-1-0

RegFlushKey
RegLoadKeyW
RegOpenKeyExW
RegGetValueW
RegEnumKeyExW
RegOpenCurrentUser
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
RegUnLoadKeyW

rpcrt4

UuidIsNil
RpcStringFreeW
UuidToStringW
UuidCreate
NdrMesTypeAlignSize2
NdrMesTypeEncode2
MesHandleFree
MesBufferHandleReset
MesEncodeFixedBufferHandleCreate
UuidFromStringW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
EnterCriticalSection
InitializeCriticalSectionEx
SetEvent
LeaveCriticalSection
ReleaseSemaphore
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapDestroy
HeapReAlloc

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateInstance
StringFromGUID2

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRStrIW
StrChrNW
StrStrIW

wldap32

ord18
ord88
ord46
ord203
ord145
ord73
ord224
ord97
ord16
ord41
ord26
ord140

cryptngc

NgcGetSymmetricPopKeyTransportKey

msvcp110_win

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualQuery

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CloseFidoAuthenticationSession
CreateAuthBuffer
CreateResourceAccountAuthBuffer
CreateTokenAuthBuffer
CreateTokenAuthBufferEx
GetFidoAuthenticationSessionStatus
GetSerializedAuthBuffer
StartChangingFidoPin
StartFidoAuthenticationSession
StartSigningFidoClientData

Sections

.text
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1f1be5194ac4b3bd4282e048fb51322

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l2-1-0

wkscli

api-ms-win-security-lsalookup-l1-1-0

netutils

api-ms-win-core-registry-l1-1-0

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

wldap32

cryptngc

msvcp110_win

api-ms-win-core-memory-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 305KB - Virtual size: 305KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 208B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 305KB - Virtual size: 305KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 208B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB