TokenBroker[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TokenBroker.dll
Size

679KB
MD5

23670e1f5a27d160fc6eee49d807da30
SHA1

32eb0eefe05bdbdcb8867c873d89e80d07d3fe4b
SHA256

eea2a1dbee7635d12379145542078b7c73c8177ea217fc9e8c44ebe76139e88b
SHA512

2197538438bc982155cb30f549f425f5f7d74ca91f0996c525cb1dff863a8689386219195bb5fb9ac3d9858438be623a97ff91db33d7388a004d906e77b678a1
SSDEEP

12288:E5W6UxQVzkQcM2V0DSjUBEQpzuBVR4cNTqNilAeZQY:EKxQVzkQcM2SDSjUBEQ+4cN6illZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TokenBroker.dll

Files

TokenBroker.dll
.dll windows:10 windows x86 arch:x86

2b5ccf575801409dadb9d30e897f5354

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TokenBroker.pdb

Imports

msvcrt

_vsnwprintf
_initterm
_ftol2
memmove
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_amsg_exit
_vsnprintf_s
free
malloc
_lock
_callnewh
_XcptFilter
memcpy
__CxxFrameHandler3
_CxxThrowException
memcpy_s
_purecall
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_onexit
?what@exception@@UBEPBDXZ
??_V@YAXPAX@Z
__dllonexit
realloc
_unlock
memcmp
wcscspn
_except_handler4_common
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
LoadLibraryExW
FreeLibraryAndExitThread
GetProcAddress
GetModuleHandleExW

api-ms-win-core-winrt-string-l1-1-0

WindowsConcatString
WindowsSubstringWithSpecifiedLength
WindowsDuplicateString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
CreateEventW
CreateMutexExW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
InitializeCriticalSectionEx
InitOnceExecuteOnce
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateSemaphoreExW
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
SetEvent
CreateEventExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseMutex
Sleep

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
ProcessIdToSessionId
GetProcessId
TlsGetValue
GetCurrentThread
SetThreadToken
OpenProcessToken
TerminateProcess
GetCurrentProcess
DeleteProcThreadAttributeList
GetCurrentThreadId
InitializeProcThreadAttributeList
CreateThread
TlsAlloc
OpenProcess
CreateProcessAsUserW
TlsFree
OpenThreadToken
TlsSetValue
UpdateProcThreadAttribute

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegDeleteValueW
RegOpenKeyExW

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoGetActivationFactory
RoInitialize

api-ms-win-core-handle-l1-1-0

CloseHandle

bcrypt

BCryptGetProperty
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptHashData

api-ms-win-security-base-l1-2-0

GetSidLengthRequired
GetAce
InitializeSid
EqualSid
AllocateAndInitializeSid
SetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
GetSidSubAuthorityCount
GetTokenInformation
CopySid
CheckTokenMembershipEx
GetSidSubAuthority
FreeSid
CreateWellKnownSid
GetLengthSid
DuplicateTokenEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

oleaut32

SysFreeString
SysAllocString
SysStringLen

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpool
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpool
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CallbackMayRunLong

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-shcore-thread-l1-1-0

SHCreateThreadRef
SHSetThreadRef

tokenbinding

TokenBindingGenerateID

ntdll

NtQueryInformationToken
RtlInitUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
memmove_s
_wcsicmp
RtlEqualSid
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
NtClose
NtCreateFile
RtlRunOnceExecuteOnce
RtlSubAuthoritySid
RtlCopySid
RtlSetEnvironmentVar
RtlQueryWnfStateData
RtlPublishWnfStateData
RtlIsMultiSessionSku
NtQuerySecurityObject
RtlCreateSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlQueryInformationAcl
RtlLengthSid
RtlAllocateHeap
RtlCreateAcl
RtlGetAce
RtlLoadString
_wcsnicmp
_itow_s
wcscpy_s
wcscat_s
tolower
RtlAddAce
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlFreeHeap
NtSetSecurityObject
RtlNtStatusToDosError
RtlFreeSid
RtlGetDeviceFamilyInfoEnum
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
wcschr

combase

ord154
ord90
ord148

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
DispatchMessageW
PostThreadMessageW
PeekMessageW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

rpcrt4

NdrClientCall4
I_RpcExceptionFilter
I_RpcMapWin32Status
RpcBindingFree
RpcBindingBind
RpcBindingCreateW

api-ms-win-core-file-l1-2-1

FindFirstFileW
FindNextFileW
SetFileInformationByHandle
ReadFile
FindClose
GetFileAttributesW
SetFileAttributesW
GetFileTime
DeleteFileW
CreateFileW
CompareFileTime
CreateDirectoryW
WriteFile
SetFilePointer
GetFileSizeEx
SetEndOfFile

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-service-private-l1-1-1

I_QueryTagInformation

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b5ccf575801409dadb9d30e897f5354

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

bcrypt

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-security-sddl-l1-1-0

oleaut32

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-shcore-thread-l1-1-0

tokenbinding

ntdll

combase

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-psapi-l1-1-0

rpcrt4

api-ms-win-core-file-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-winrt-propertysetprivate-l1-1-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 623KB - Virtual size: 623KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 352B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 42KB - Virtual size: 41KB

.text
Size: 623KB - Virtual size: 623KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 352B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 42KB - Virtual size: 41KB