starware_auth[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
starware_auth.dll
Size 5.1MB
Sample260625-2edbaags3l
SHA256 a4d938926c8aee82e5b75e3f21ae938a2a03c516b9f43229a829c87272eab0b5
MD5 72e5b9b3d683af640be7417fe17ae39d
SHA1 78958519445e46cca8106a3079332b29ae23dfba
SHA512 4471638068051db33402e6572ff3e2b17ff57b659bc1a20d4b6645a800ffcc0f7ad86fe31b211b9b73875dae620f43d2900fbdd8659427e6b6d48513bf5983c5
SSDEEP 98304:2b5T18dvOeo0Zbxb8bZBmWwjEaotq+4L:2b5TudvOeo0ZFAbZBmWwjEaokP
TLSH
T18A469DA9B5BC0056D46BC2BCC287A227D772746517B057CF2A649AF90F63BE0277B700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
starware_auth.dll

File Explorer

starware_auth.dll

.dll 5.1MB

starware_auth.dll

IMPHASH 6e7ecdd67449d29f945990cbcef065ee
SHA256 a4d938926c8aee82e5b75e3f21ae938a2a03c516b9f43229a829c87272eab0b5
MD5 72e5b9b3d683af640be7417fe17ae39d
SHA1 78958519445e46cca8106a3079332b29ae23dfba
SHA512 4471638068051db33402e6572ff3e2b17ff57b659bc1a20d4b6645a800ffcc0f7ad86fe31b211b9b73875dae620f43d2900fbdd8659427e6b6d48513bf5983c5
SSDEEP 98304:2b5T18dvOeo0Zbxb8bZBmWwjEaotq+4L:2b5TudvOeo0ZFAbZBmWwjEaokP
TLSH
T18A469DA9B5BC0056D46BC2BCC287A227D772746517B057CF2A649AF90F63BE0277B700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3781452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

bind gethostbyaddr inet_ntoa inet_addr htons htonl getservbyname closesocket connect listen setsockopt socket shutdown WSACleanup getpeername recvfrom sendto WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAIoctl __WSAFDIsSet getaddrinfo freeaddrinfo gethostname WSAGetLastError WSASetLastError send accept getservbyport ioctlsocket getsockname getsockopt ntohs select gethostbyname WSAStartup recv

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertOpenSystemStoreW CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

bcrypt

BCryptGenRandom

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation

advapi32

CryptGetUserKey CryptHashData CryptGetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey DeregisterEventSource CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW

kernel32

FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SleepEx InitializeCriticalSectionEx QueryPerformanceFrequency InitializeConditionVariable GetFullPathNameW MoveFileExW GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW LoadLibraryW SystemTimeToFileTime GetSystemTime CreateSemaphoreA GetExitCodeThread InitializeSListHead WaitForSingleObject ReleaseSemaphore DeleteCriticalSection ReadFile PeekNamedPipe WaitForMultipleObjects LocalFree WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx CreateThread RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent DisableThreadLibraryCalls QueryPerformanceCounter GetCurrentThreadId GetStdHandle GetFileType WriteFile GetLastError GetModuleHandleW GetProcAddress MultiByteToWideChar RtlVirtualUnwind SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree Sleep GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA GetModuleHandleExW GetCurrentProcessId GetSystemTimeAsFileTime VirtualFree GetEnvironmentVariableW WideCharToMultiByte GetACP CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection

msvcp140

?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr memchr strrchr wcschr memcmp wcsstr memmove memset memcpy __std_terminate __std_exception_copy __std_exception_destroy __current_exception __current_exception_context __C_specific_handler _CxxThrowException __std_type_info_destroy_list strchr

api-ms-win-crt-runtime-l1-1-0

_errno _invoke_watson _configure_narrow_argv _initialize_narrow_environment terminate _register_onexit_function _execute_onexit_table strerror_s raise _exit _crt_atexit _initialize_onexit_table signal _seh_filter_dll _beginthreadex _cexit _initterm_e _initterm

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoul

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 strftime

api-ms-win-crt-string-l1-1-0

strcat_s wcsncmp wcscpy_s strncpy_s isdigit strpbrk strncmp wcslen wcscmp isspace strcpy strspn strcmp strcspn strcpy_s strlen strncpy tolower wcsncpy_s _strdup

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free realloc calloc

api-ms-win-crt-stdio-l1-1-0

fopen __acrt_iob_func _wfopen __stdio_common_vfprintf __stdio_common_vswprintf fclose __stdio_common_vsprintf _setmode __stdio_common_vsprintf_s fputc _get_osfhandle fwrite feof ftell _wsopen_s _wfsopen fseek _fseeki64 fread _close _fileno _read _write _lseeki64 fgets fflush ferror fputs

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fullpath _fstat64 _stat64i32 _unlink

api-ms-win-crt-math-l1-1-0

_fdopen