cgauth[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cgauth.dll
Size

359KB
MD5

db18e3696e4e34c354e340de4fc71089
SHA1

47a444d641c4d78b66e87ec8d874cdeabad81eb6
SHA256

62562beab22543e693650b2054ec9be29e5755fbcd33e3be85493aecce81e304
SHA512

e95430a98a67ab3b6a4a07000f01309583c5980781ae74f1b58b9b7147583f11b3733da8ac5ce6c945e946ec486485966a558b63d95c6b43333124b1f835e453
SSDEEP

6144:kWjOBPnDYPYGVd18pAEKKlq1gkeMn28U1FzAup7bCmETo6U0CELWTZP:gBPnDYP0ToneRfz/9gToNEgP

Score

1^/10

Malware Config

Signatures

Files

cgauth.dll
.dll windows:6 windows x64 arch:x64

fe6ca52c2a2afb49e045ff0e533fd235

Code Sign

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d2:e0:54:2a:e3:b0:2d:ab:08:17:51:a4:25:78:d9
Certificate

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

27/05/2024, 00:00

Not After

12/06/2025, 23:59

Subject

SERIALNUMBER=HRB 726749,CN=Chaos Software GmbH,O=Chaos Software GmbH,L=Karlsruhe,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13084d616e6e6865696d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a4:06:af:3d:34:76:f2:f6:cb:96:b7:b0:88:31:49:3b:aa:13:dd:ea
Signer

Actual PE Digest

a4:06:af:3d:34:76:f2:f6:cb:96:b7:b0:88:31:49:3b:aa:13:dd:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\CI\j\workspace\core\libpak_build\Windows_MSVS_140_single\sdkoutput\libpak_cgauth\cgauth.pdb

Imports

advapi32

FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid

kernel32

RaiseException
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
GetCurrentProcess
GetCurrentProcessId
SwitchToThread
GetCurrentThreadId
GetTempPathA
GetComputerNameA
CreateDirectoryA
CreateFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetLastError
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleExW
K32GetModuleFileNameExW
GetFileAttributesW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
GetProcAddress
CreateDirectoryW
CreateFileA
OutputDebugStringW
LocalFree
FormatMessageW
MultiByteToWideChar
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetThreadPriority
SetThreadPriorityBoost
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcessAffinityMask
SetThreadAffinityMask
GetActiveProcessorGroupCount
GetActiveProcessorCount
GetEnvironmentVariableA
GetVolumeInformationA
CloseHandle
TerminateProcess
OutputDebugStringA
LocalAlloc
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
GetTickCount

ole32

CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

shell32

SHGetFolderPathA

user32

PeekMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjectsEx

ws2_32

recvfrom
accept
bind
closesocket
connect
inet_addr
getsockname
getsockopt
listen
recv
htonl
select
send
setsockopt
shutdown
socket
WSAStartup
htons
WSACleanup
gethostbyname
WSAGetLastError

msvcp140

?get_new_handler@std@@YAP6AXXZXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

dbghelp

MiniDumpWriteDump

vcruntime140

strchr
__C_specific_handler
memcmp
__std_exception_copy
__std_exception_destroy
_CxxThrowException
strstr
strrchr
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
memcpy
_purecall
memset
memmove
__CxxFrameHandler3

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-string-l1-1-0

strpbrk
strcmp
strtok
_stricmp
_strnicmp
tolower
strncpy

api-ms-win-crt-runtime-l1-1-0

terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_beginthread
_invalid_parameter_noinfo_noreturn
_beginthreadex

api-ms-win-crt-time-l1-1-0

_time64
_localtime64

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

realloc
calloc
free
malloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

modf
llround

api-ms-win-crt-convert-l1-1-0

mbstowcs
atoi
atol

Exports

Exports

?deleteAuthServer@@YAXPEAVAuthServer@@@Z
?getAuthServer@@YAPEAVAuthServer@@XZ
?newAuthServer@@YAPEAVAuthServer@@XZ
?setVRLSettingsCallback@@YAXP6AHAEAUVRLSettings@@@Z@Z

Sections

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe6ca52c2a2afb49e045ff0e533fd235

Code Sign

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29Certificate

Extended Key Usages

Key Usages

0c:d2:e0:54:2a:e3:b0:2d:ab:08:17:51:a4:25:78:d9Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

a4:06:af:3d:34:76:f2:f6:cb:96:b7:b0:88:31:49:3b:aa:13:dd:eaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ole32

oleaut32

shell32

user32

ws2_32

msvcp140

dbghelp

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 219KB - Virtual size: 218KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 5KB - Virtual size: 13KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

0c:d2:e0:54:2a:e3:b0:2d:ab:08:17:51:a4:25:78:d9
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

a4:06:af:3d:34:76:f2:f6:cb:96:b7:b0:88:31:49:3b:aa:13:dd:ea
Signer

.text
Size: 219KB - Virtual size: 218KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 5KB - Virtual size: 13KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB