WcnEapAuthProxy[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WcnEapAuthProxy.dll
Size

19KB
MD5

11d1846fca7d8a5eb825cd731a0f6304
SHA1

f248310af3442fd9b60b85c4a68acf50ba7c4932
SHA256

9037a7e798563bea15f603ecd5f6bb27f569057735c0d45f36192830f5147af8
SHA512

109481c76699151de09bf63ad22a90fe503310448238bb4f89def7631362bfe5a19a0a67bdb007ed2c7db3354080323a8e53fa41806052bbed320d37fa258bd4
SSDEEP

384:pBFRpz2b8DJTkjj8QqR2inkVAqOgU3xAv5dVf+F/jtOeHCWwPWNtLWC+:lgCgeAsoWXtJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WcnEapAuthProxy.dll

Files

WcnEapAuthProxy.dll
.dll windows:6 windows x86 arch:x86

d89a3348f22ed1305ff11c34147e17dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WcnEapAuthProxy.pdb

Imports

msvcrt

_unlock
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
free
_CxxThrowException
_callnewh
malloc
_XcptFilter
_onexit
_lock
__dllonexit
__CxxFrameHandler3
??1type_info@@UAE@XZ
_except_handler4_common
_amsg_exit
_initterm

ntdll

EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwTraceMessage

rpcrt4

RpcAsyncCancelCall
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcMgmtInqServerPrincNameW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
NdrAsyncClientCall
RpcSmDestroyClientContext
RpcAsyncInitializeHandle
RpcExceptionFilter
RpcAsyncCompleteCall
UuidCreate

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls

api-ms-win-core-misc-l1-1-0

Sleep
LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
InitializeSRWLock
ResetEvent
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

Exports

Exports

WcnEapPluginGetInfo

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d89a3348f22ed1305ff11c34147e17dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB