AuthBroker[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AuthBroker.dll
Size

98KB
MD5

d326da6fbeccc5dee821c18772649578
SHA1

03ae8c75c72dc7cb219e5fb4882254a3cdcd1da7
SHA256

e500c64f8647b921e22e9afa6117d63c3b91c7de85a894608516973dd4a412f8
SHA512

4f3e6633291c792237ca60bd298fd73a0586dab7549a6ec2085cae5ed4fe6f98368679cfae9efcde643183920f893e74bd4d611bb765092ad718767b649bfd82
SSDEEP

1536:9NZZi2xA423uoO0CqLYOZZxzW/WTB4yG7XwIg/KaLFp6jPS6FsprAo7SJYSrJlLj:BZxxAgmZxzNTReYSr3L0Y1QkHmAZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AuthBroker.dll

Files

AuthBroker.dll
.dll regsvr32 windows:6 windows x86 arch:x86

ffa3bee4a0d0f0b296bc6385d3c13ded

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AuthBroker.pdb

Imports

msvcrt

memcpy
_except_handler4_common
__CxxFrameHandler3
??2@YAPAXI@Z
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
_purecall
memcmp
memset

ntdll

RtlEqualSid
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
_vsnwprintf
RtlInitializeCriticalSection
WinSqmAddToStream
wcstoul
_wcsnicmp
_wcsicmp

rpcrt4

IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_CountRefs
I_RpcBindingInqLocalClientPID

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
HSTRING_UserSize
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsDeleteString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDuplicateString
HSTRING_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
WindowsCreateString

api-ms-win-core-synch-l1-2-0

CreateMutexW
WaitForMultipleObjectsEx
CreateEventW
AcquireSRWLockExclusive
WaitForSingleObject
AcquireSRWLockShared
Sleep
ReleaseSRWLockShared
ReleaseSRWLockExclusive
SetEvent
ReleaseMutex
CreateEventExW
InitOnceExecuteOnce

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
IsErrorPropagationEnabled
RoTransformError
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
GetProcessIdOfThread
OpenThread
GetCurrentProcess
TerminateProcess
OpenThreadToken
ResumeThread
CreateThread
TlsSetValue
TlsFree
TlsGetValue
GetExitCodeProcess
SetThreadToken
OpenProcessToken
DeleteProcThreadAttributeList
CreateProcessW
OpenProcess
UpdateProcThreadAttribute
InitializeProcThreadAttributeList

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW

api-ms-win-security-base-l1-2-0

ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetTokenInformation
FreeSid
CheckTokenCapability

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns

wkscli

NetGetJoinInformation

netutils

NetApiBufferFree

api-ms-win-core-kernel32-legacy-l1-1-1

WaitForMultipleObjects

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-wow64-l1-1-0

IsWow64Process
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-url-l1-1-0

ParseURLW

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

combase

ord15
ord18
ord33
ord7
ord6
ord32
ord5
ord2
ord34
ord13
ord11
ord16
ord14
ord12
ord10
ord17
ord9
ord8
ord19

wininet

InternetCrackUrlW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

AuthBrokerClearThreadClientContext
AuthBrokerCreateClientContext
AuthBrokerFreeClientContext
AuthBrokerSetThreadClientContext
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllInstall
DllRegisterServer
PurgeAuthHostSsoCache

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 285B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffa3bee4a0d0f0b296bc6385d3c13ded

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-threadpool-l1-2-0

wkscli

netutils

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-shell-shellfolders-l1-1-0

combase

wininet

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 71KB

.orpc Size: 512B - Virtual size: 285B

.data Size: 1024B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

minATL Size: 512B - Virtual size: 20B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 71KB - Virtual size: 71KB

.orpc
Size: 512B - Virtual size: 285B

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

minATL
Size: 512B - Virtual size: 20B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 10KB - Virtual size: 10KB