SessionTicketAuth[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SessionTicketAuth.dll
Size

93KB
MD5

68483229567a21f6bc0d95c992a68f38
SHA1

2b4eb3f21846d0f533e326715c472c195ea2ed70
SHA256

833999892f4445b352ca9bb9d5515b85aeb31a47e9b71b62c8abe3a9b537908f
SHA512

d1a841a16442a083a471870c2535ab9fefeece49b2fc989e20eb0e9e4f1d02bb49ef89b4848bcf7ab059bebfddb69134b6b0abdafe0329c65c0f7d12c962443f
SSDEEP

1536:K6fb+5CSAsePCHlJ4Hvk0HfHmL6Gq/avlFnY0anx3D/7bgM:K6bkuCRCHa6GeaCp/7bgM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SessionTicketAuth.dll

Files

SessionTicketAuth.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ