authanon[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

authanon.dll
Size

39KB
MD5

dcaf5fbfa48d0e651ee95a3e8c703770
SHA1

d3d22e947ffd01802b6a9c8bb363a3d3fb07ccec
SHA256

4717c7306c36695b03e285059a4ffb99deab957fe79995dba4d430f642c6582f
SHA512

592b8873a0d5154896b71053b00023efd00f4a9ce63aa17d6d45a73405c57e15f37742a9b344096bc5bec7fe9bd8dcb852302d5e6806d56bdd3af69482c42343
SSDEEP

768:HznDkCS+EskhQTXDVtchnrzI3iWWXimWKX0EPLyWB:HrDkCS+uhitchnQ3iWWtWiD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
authanon.dll

Files

authanon.dll
.dll windows:10 windows x64 arch:x64

521702284ed2f319479d4fe72a6863b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

authanon.pdb

Imports

msvcrt

wcsncpy_s
wcschr
wcspbrk
_wcsupr
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
??1type_info@@UEAA@XZ
strcmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-security-base-l1-2-0

DuplicateTokenEx
GetTokenInformation
CopySid
GetKernelObjectSecurity

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW

iisutil

?QueryPtr@BUFFER@@QEBAPEAXXZ
??0STRU@@QEAA@PEAGK@Z
?IsEmpty@STRU@@QEBA_NXZ
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Resize@BUFFER@@QEAA_NK@Z
?QueryStr@STRU@@QEAAPEAGXZ
??1CSmallSpinLock@@QEAA@XZ
??0CSmallSpinLock@@QEAA@XZ
?QueryCB@STRU@@QEBAKXZ
DisableTokenBackupPrivilege
PuDbgPrint
?QueryStr@STRU@@QEBAPEBGXZ
EncryptMemoryPassword
?Copy@STRU@@QEAAJPEBG@Z
??0STRU@@QEAA@XZ
??1STRU@@QEAA@XZ
PuDeleteDebugPrintsObject
IISGetPlatformType
PuLoadDebugFlagsFromRegStr
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
?SetLen@STRU@@QEAA_NK@Z
?Copy@STRU@@QEAAJPEBGK@Z
?Resize@STRU@@QEAAJK@Z
?QuerySize@BUFFER@@QEBAKXZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@PEAEK@Z
??0BUFFER@@QEAA@XZ
?QueryStr@STRA@@QEAAPEADXZ
?QueryCCH@STRA@@QEBAKXZ
PuCreateDebugPrintsObject
DecryptMemoryPassword
?IsEmpty@STRA@@QEBA_NXZ

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-security-logon-l1-1-0

LogonUserExW

cryptsp

CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptGetHashParam
CryptReleaseContext

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

RegisterModule

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

521702284ed2f319479d4fe72a6863b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

iisutil

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-security-logon-l1-1-0

cryptsp

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 280B

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 280B