Secur32[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Secur32.dll
Size 2.6MB
Sample260726-3apdessxfs
SHA256 38e74ff8d5f02617ff8858d9094b455d4e999223c7f78726584690e7201d94b7
MD5 dc5859aa3e12e2bd3e04f1b9d4142abb
SHA1 d451fd0b6b9cdf481a5867ddcfcccfbe8a0739a8
SHA512 4dfbf5c19574ff7125fac0dca065e367e098ada7e47ccfffc6c8f0cf271ded3c61cf371d35b9d5a6a35632172e721ea7d0ce6cbcc5d6aeb11c3f9536ea37f16e
SSDEEP 49152:cC4a6XLfjdh10PNV/S/fZ1V+XuACVfeQ17zQOTIWiK8M7YzhXdRxd:q0PuACVfeQ17zQOTIWiK8M7YzhXdRxd
TLSH
T136C5CF55A3D855A8D467DA388B15E332C2B1B9234B75E08F0A99C7091F77E924F3FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Secur32.dll

File Explorer

Secur32.dll

.dll 2.6MB

Secur32.dll

IMPHASH b1c022f21e313c400a3bd74350a836c9
SHA256 38e74ff8d5f02617ff8858d9094b455d4e999223c7f78726584690e7201d94b7
MD5 dc5859aa3e12e2bd3e04f1b9d4142abb
SHA1 d451fd0b6b9cdf481a5867ddcfcccfbe8a0739a8
SHA512 4dfbf5c19574ff7125fac0dca065e367e098ada7e47ccfffc6c8f0cf271ded3c61cf371d35b9d5a6a35632172e721ea7d0ce6cbcc5d6aeb11c3f9536ea37f16e
SSDEEP 49152:cC4a6XLfjdh10PNV/S/fZ1V+XuACVfeQ17zQOTIWiK8M7YzhXdRxd:q0PuACVfeQ17zQOTIWiK8M7YzhXdRxd
TLSH
T136C5CF55A3D855A8D467DA388B15E332C2B1B9234B75E08F0A99C7091F77E924F3FB02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

K32GetProcessMemoryInfo SetLastError FormatMessageW GetLastError CloseThreadpoolIo MultiByteToWideChar GetStdHandle RaiseFailFastException GetTickCount64 GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW LocalAlloc GetConsoleOutputCP WideCharToMultiByte GetProcAddress CreateIoCompletionPort CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW CreateDirectoryW GetFileAttributesW CreateProcessW FreeConsole GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStringTypeW HeapSize HeapReAlloc SetStdHandle GetConsoleMode SetFilePointerEx WriteConsoleW FlushProcessWriteBuffers WaitForSingleObjectEx RtlRestoreContext AddVectoredExceptionHandler CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity

ole32

CoGetApartmentType CoUninitialize CoInitializeEx CoTaskMemFree CoWaitForMultipleHandles

vcruntime140

_CxxThrowException __std_terminate __std_exception_destroy __std_exception_copy _purecall memmove memset __C_specific_handler __std_type_info_destroy_list memcpy __CxxFrameHandler3 __C_specific_handler_noexcept

vcruntime140_1

__CxxFrameHandler4

1oNa2eTl3QmSRib 2NjbvrOPaUOKmeRG5lrf9UnJi 300pAfeODdMmNPQxKPiKK8zBwx2tpKh 3jytljiQ8cAxjvEPo 3lXpZdt 3w6ixQp3mZo3TGpEUE6fw4K 5F3hGeKnZoQdImdvIwCzuBUzyO4948jk 643q6x4rJZxNgIzuWDqQSl 6KgN85DEF5xPH8ZWKWQcO2g5C 8AFmtBk 8srMSaFtF6M4K7auIWAVhaTi1 8txzPDt4dFum4JrH 9QxfkuHmqa 9ryMFUv2R1F ALlcNKcbvLVmlhsXU26St7QCJ AcceptSecurityContext AcquireCredentialsHandleA AcquireCredentialsHandleW AddCredentialsA AddCredentialsW AddSecurityPackageA AddSecurityPackageW ApplyControlToken ChangeAccountPasswordA ChangeAccountPasswordW CompleteAuthToken CredMarshalTargetInfo CredUnmarshalTargetInfo DHyyW9e228xB7nBGhPk5K4j02w3M8q DJiGweCX DYJqdP1m0NDnFibVV3kc DecryptMessage DeleteSecurityContext DeleteSecurityPackageA DeleteSecurityPackageW Dtj1FB9f2NY1StU3 DuyC4FJ3 Dvta2eQh46 EGr1Qj0A0 EPCoUTJkju5q1ErT EncryptMessage EnumerateSecurityPackagesA EnumerateSecurityPackagesW ExportSecurityContext EzT6O6ec52vlpMXZ7FJIhN F6FWEVfY9 FLOYAaPwCLU7YFFLPUSkNu6YCIg FfTjWd5s9uN2YycC0ebuKY5HkCxD FkBDI6Ui3DuYY6jgDB9EGWOl2o FreeContextBuffer FreeCredentialsHandle G9ErVUsLEytFtPV5IIrwBb8llfXhq1w GSkeyBeocr4mxaGXLH44JhWFHzoa GUBck31Bzo7HtQ7iXPCTcjH3z3TPdC GetComputerObjectNameA GetComputerObjectNameW GetSecurityUserInfo GetUserNameExA GetUserNameExW Gk666rmliobWADIGMAbv HJCDmF95c2RAnfGnduuzAQmcdkl ImpersonateSecurityContext ImportSecurityContextA ImportSecurityContextW InitSecurityInterfaceA InitSecurityInterfaceW InitializeSecurityContextA InitializeSecurityContextW JezTKzyW73iIazKlIi5g4qlWzh0w1na KlywTwi LTmFw7dYjJI1eoHsczhTNBzit3cUAbNP LsaCallAuthenticationPackage LsaConnectUntrusted LsaDeregisterLogonProcess LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification LsaUnregisterPolicyChangeNotification LvPe9TtcksZkBlqLFin MZJMUBlU8KZj7H6x3GzWan8 MakeSignature NG0Pc4ttx4TJu4z6HiAoukA NH0BjXZIR NmUFMx31RidZmUtCLpdRHVmVpRCq O5GyHxKNdhf3L24daWwgfJ6Yqbw9 Ovoip51XnwUaJshopoWAjC7v PzLLA29Tfbpn2Pm4g5 QV2qxwxCEs7cFs6Sml2EPHjAa QbCwBGLOATi1D33A QueryContextAttributesA QueryContextAttributesW QueryCredentialsAttributesA QueryCredentialsAttributesW QuerySecurityContextToken QuerySecurityPackageInfoA QuerySecurityPackageInfoW RJUXYKtmIIYBY5n3CgiPlpj3P9B RMdFksCrsGIqDyf3xK9f9G9a RevertSecurityContext SaslAcceptSecurityContext SaslEnumerateProfilesA SaslEnumerateProfilesW SaslGetContextOption SaslGetProfilePackageA SaslGetProfilePackageW SaslIdentifyPackageA SaslIdentifyPackageW SaslInitializeSecurityContextA SaslInitializeSecurityContextW SaslSetContextOption SealMessage SeciAllocateAndSetCallFlags SeciAllocateAndSetIPAddress SeciFreeCallContext SecpFreeMemory SecpTranslateName SecpTranslateNameEx SetContextAttributesA SetContextAttributesW SetCredentialsAttributesA SetCredentialsAttributesW SqOd1XtLyS6 SspiCompareAuthIdentities SspiCopyAuthIdentity SspiDecryptAuthIdentity SspiEncodeAuthIdentityAsStrings SspiEncodeStringsAsAuthIdentity SspiEncryptAuthIdentity SspiExcludePackage SspiFreeAuthIdentity SspiGetTargetHostName SspiIsAuthIdentityEncrypted SspiLocalFree SspiMarshalAuthIdentity SspiPrepareForCredRead SspiPrepareForCredWrite SspiUnmarshalAuthIdentity SspiValidateAuthIdentity SspiZeroAuthIdentity TranslateNameA TranslateNameW UnsealMessage V3XU8XLOaSQrX4 VQBUses0uiZUlU VerifySignature X2FDrqgaGL Y6egtehsHgbO33rIk YBzyLTjqI0nXNdZ YzwTl3hC8GLPE84Wh2fekyWZoKazKGL Z2eCvo7dDMQIF ZXFwnZHr8MgZEwzfkivD1q a86Y2JU2S7GSfRW3r aLj6f5D5iOWsLuUz afTwoZYM3iEnGkgTooC84BgGRu3Bf agjCMAGaLtXqUxab9 bDBcfKFRYKxJzi3z bSdzeZuYmqpuQ6VNY5997DCL davy4zWwarh3zCA dhfvOLvDrdRnF7YeSzR1jQL4RySZ dnNERhp4ctF h3hopyV hh5MUXo8 hmpGAxhxy3JyXWhHEdEZm iDxRixzCtHnJCC iO0OlHsnh impy4XkBbV jEU5r24 jiMR2vJ9tY2cbW7nhEFWozxP2xM3 jkrYWhEXvwvIhEDAobuMBKn kjrM15qjymkdpzbZVq lqw5j5PXgtktqe5xqsq5tPN mh2RWwTfVoFYzbJZQq0tmZme nBn7eiOTrmWunGTmp6QRH6aX7JE8wh o8tnSkBByPojQXmRCwOvp pA2lH03UGHTBCp pPy7ch0qVcnys85 pQIiQX3kxqgTBj2BwwlD3lQ05F qoaAr4Iyw51QuT9JgyRnGQNcVKPVfW rPrDyGOf2oY3Omy7Rv47A0Gn0nTmK rp0ouUk4EObLR98JRSRBpxEtgW5 sdTpgaNhxiypLd6OyIL2yLxCxT tivirqJjHWiZTAmem tkWF3cpLZ2EjsixZSGlfxATwxtarj uSdF5n0Ot up44V4sBIt4PstgZkS3SF1wt utIcdt48yDPyJPBfPuZX vJuGRILHgIMu5PlxJs8 vUD82pCvrodaUWqAdqAHYS3bWDfv y4uQKUCO yMDhRn1BfNv82j yRx8aqcRcHiSZR0JdvPNZfBEJg yjwXuON943IH6 zypJGXomTUiMFKENjF

Name

.text

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

720KB

Virtual Size

720KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

345KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

671KB

Virtual Size

670KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

740KB

Virtual Size

739KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Secur32.dll

advapi32

bcrypt

kernel32

ole32

vcruntime140

vcruntime140_1

generic