authbas[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

authbas.dll
Size

37KB
MD5

0b3bb8aad167555c11a6dd6232071799
SHA1

0dabc0df4adb546f2bd9707805934cf3e3b2efef
SHA256

7f8357a0efc9a5f38fb822e80db9c04bcc330c753715d268dfe33bb83234d9b2
SHA512

729bc9062014ab79a014abc91ab61ac03c09bf3a3cfe1ff110559ff7ed3d12be637661b438289fee09ac2ba0cec6035988dc6cf0a3af8ac6f632b4420824cc0e
SSDEEP

768:v5Xu8s3Iqm2H7hYylP2CWK8ql2Bx2fLCT:Re8s4mqyhlWmOx2Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
authbas.dll

Files

authbas.dll
.dll windows:10 windows x64 arch:x64

7b3ace577d8c80855863342bd958bd8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

authbas.pdb

Imports

msvcrt

wcsncpy_s
wcschr
_wcsupr
wcspbrk
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
strchr
_strnicmp
??1type_info@@UEAA@XZ
strcmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW

iisutil

??0STRA@@QEAA@PEADK@Z
??1STRA@@QEAA@XZ
?Copy@STRA@@QEAAJPEBD@Z
?AppendW@STRA@@QEAAJPEBG@Z
?Append@STRA@@QEAAJPEBD@Z
??0STRU@@QEAA@PEAGK@Z
??0STRU@@QEAA@XZ
?Copy@STRA@@QEAAJPEBDK@Z
??1BUFFER@@QEAA@XZ
?CopyA_ACP@STRU@@QEAAJPEBD@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
??0STRA@@QEAA@XZ
?Copy@STRU@@QEAAJAEBV1@@Z
?Copy@STRU@@QEAAJPEBG@Z
PuDeleteDebugPrintsObject
??1STRU@@QEAA@XZ
PuLoadDebugFlagsFromRegStr
PuCreateDebugPrintsObject
?CopyA@STRU@@QEAAJPEBD@Z
PuDbgPrint
DisableTokenBackupPrivilege
?Resize@BUFFER@@QEAA_NK@Z
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
?SetLen@STRU@@QEAA_NK@Z
?Resize@STRU@@QEAAJK@Z
?Copy@STRU@@QEAAJPEBGK@Z
uudecode
??0BUFFER@@QEAA@XZ

api-ms-win-security-base-l1-2-0

GetKernelObjectSecurity
DuplicateTokenEx
GetTokenInformation

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-logon-l1-1-0

LogonUserExW

cryptsp

CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

RegisterModule

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b3ace577d8c80855863342bd958bd8c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

iisutil

api-ms-win-security-base-l1-2-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-logon-l1-1-0

cryptsp

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 284B

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 284B