auditcse[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

auditcse.dll
Size

203KB
MD5

739cfa2eb4e31f9b7829738ce184183b
SHA1

1208a9882785ded7e4d2cb889bd750d51125acee
SHA256

90afb795083650977d3878c99e1e0d667d1ec31787a271850a56603f0f524496
SHA512

ed288c2614fc4bdbc7d0399e9ca152523e154834d86d84d36db97eac8c6f2eb90833961d6466e281d628b5e314038fd43736dc6d1bfd6e1e4610f2a963fe4ac4
SSDEEP

3072:v4kC3lVg7UQyH+9kkGuSEsjGjyfxT2MhvJx/ACgFYMqUXCSLc:vPC3sYQj9/Gt0jNYxRgqIXCS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
auditcse.dll

Files

auditcse.dll
.dll windows:6 windows x64 arch:x64

6b5e4577ab092c54843f5b2f255d2c3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

auditcse.pdb

Imports

msvcrt

feof
fgetws
_wtoi
__dllonexit
_onexit
memcpy_s
_wfopen_s
fclose
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_callnewh
malloc
free
tolower
_purecall
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
_unlock
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
memcmp
__RTDynamicCast
memcpy

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
LeaveCriticalSection
Sleep
GetCurrentProcess
GetCurrentThread
LocalAlloc
CopyFileW
ExpandEnvironmentStringsW
LocalFree
CloseHandle
FreeLibraryAndExitThread
CreateThread
LoadLibraryW
DisableThreadLibraryCalls
FreeLibrary
EnterCriticalSection
GetLastError
DeleteCriticalSection
InitializeCriticalSection

userenv

ProcessGroupPolicyCompletedEx

advapi32

RevertToSelf
ConvertSidToStringSidW
RegCloseKey
EventWrite
EventEnabled
EventUnregister
EventRegister
AuditLookupSubCategoryNameW
AuditEnumerateSubCategories
AuditFree
CopySid
GetLengthSid
LsaSetCAPs
AuditSetGlobalSaclW
GetSecurityDescriptorSacl
RegSetValueExW
RegOpenKeyExW
AuditSetPerUserPolicy
AuditSetSystemPolicy
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
ImpersonateSelf
OpenThreadToken
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidToStringW

ole32

CoCreateGuid

oleaut32

SafeArrayPutElement
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantInit
SysFreeString
SysAllocString

shell32

SHCreateDirectoryExW

setupapi

SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW

Exports

Exports

GenerateGroupPolicy
GenerateGroupPolicyCap
ProcessGroupPolicyEx
ProcessGroupPolicyExCap

Sections

.text
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b5e4577ab092c54843f5b2f255d2c3c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

userenv

advapi32

rpcrt4

ole32

oleaut32

shell32

setupapi

Exports

Exports

Sections

.text Size: 182KB - Virtual size: 182KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 7KB - Virtual size: 6KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 264B

.text
Size: 182KB - Virtual size: 182KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 7KB - Virtual size: 6KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 264B