AuthBroker[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

AuthBroker.dll
Size

115KB
MD5

4a7ad501b449ced36ac774ee6a6ff0b0
SHA1

341470c1d1d58d250c0273ed100edef77febc77d
SHA256

ccfaa7fe0bd6eb949a3d3c806ff106235db32f64da0d5a829e545c5b621c6f75
SHA512

bd0cee4df0ed796d3d68886ed774e56f215b496582b38e2b8aef7bd10497318a34c34f524eda78a9c4152ec5d1d1f519e307971545075ea897b8918cca9ac5b5
SSDEEP

3072:yfOLaVyeQ3pxvqzgQfpMYSrKGKEnRkQa:yfnyR3Lvq8QfCnk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AuthBroker.dll

Files

AuthBroker.dll
.dll regsvr32 windows:10 windows x86 arch:x86

f59eb41bde11ca264dd8830dc9fc5809

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AuthBroker.pdb

Imports

msvcrt

_purecall
_onexit
memcpy
__dllonexit
_lock
__CxxFrameHandler3
_initterm
malloc
_unlock
_except_handler4_common
_amsg_exit
_XcptFilter
free
memcmp
_callnewh
memset

rpcrt4

I_RpcBindingInqLocalClientPID
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubForwardingFunction
NdrStubCall2
IUnknown_Release_Proxy

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsCreateString
WindowsDeleteString
HSTRING_UserUnmarshal
WindowsGetStringRawBuffer
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
WindowsGetStringLen
WindowsStringHasEmbeddedNull
WindowsDuplicateString

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation
EventUnregister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags

api-ms-win-core-winrt-error-l1-1-1

GetRestrictedErrorInfo
SetRestrictedErrorInfo
IsErrorPropagationEnabled
RoOriginateErrorW
RoTransformError
RoOriginateError
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateMutexW
SetEvent
Sleep
CreateEventExW
AcquireSRWLockShared
ReleaseMutex
InitOnceExecuteOnce
WaitForSingleObject
WaitForMultipleObjectsEx

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction4
ObjectStublessClient4
ObjectStublessClient16
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction5
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction3
ObjectStublessClient10
CStdStubBuffer2_Connect
ObjectStublessClient18
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient20
ObjectStublessClient19
ObjectStublessClient3
ObjectStublessClient15
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient5
ObjectStublessClient17
ObjectStublessClient21
CStdStubBuffer2_CountRefs
ObjectStublessClient6

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
CreateThread
CreateProcessW
OpenThread
OpenProcessToken
GetProcessIdOfThread
OpenProcess
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
SetThreadToken
GetCurrentThreadId
GetExitCodeProcess
TlsAlloc
TlsGetValue
TlsSetValue
TerminateProcess
GetProcessId
ResumeThread
GetCurrentProcessId
GetCurrentThread
OpenThreadToken
TlsFree
DeleteProcThreadAttributeList

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
LoadStringW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

api-ms-win-security-base-l1-2-0

AllocateAndInitializeSid
GetTokenInformation
ImpersonateLoggedOnUser
FreeSid
CheckTokenCapability

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-wow64-l1-1-0

Wow64DisableWow64FsRedirection
IsWow64Process
Wow64RevertWow64FsRedirection

wkscli

NetGetJoinInformation

netutils

NetApiBufferFree

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork

winhttp

WinHttpCrackUrl

api-ms-win-core-url-l1-1-0

ParseURLW

api-ms-win-core-marshal-l1-1-0

HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
HWND_UserFree

combase

ord140

ntdll

RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
WinSqmAddToStream
wcstoul
_wcsnicmp
_wcsicmp
_vsnwprintf
RtlInitializeCriticalSection
RtlEqualSid

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AuthBrokerClearThreadClientContext
AuthBrokerCreateClientContext
AuthBrokerFreeClientContext
AuthBrokerSetThreadClientContext
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllInstall
DllRegisterServer
FindCallingThreadImmersiveWindow
PurgeAuthHostSsoCache

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f59eb41bde11ca264dd8830dc9fc5809

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-wow64-l1-1-0

wkscli

netutils

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-threadpool-l1-2-0

winhttp

api-ms-win-core-url-l1-1-0

api-ms-win-core-marshal-l1-1-0

combase

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 96KB

.data Size: 512B - Virtual size: 17KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 324B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 96KB - Virtual size: 96KB

.data
Size: 512B - Virtual size: 17KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 324B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB