accountaccessor[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
accountaccessor.dll
Size 296KB
Sample261014-13ectaaw7k
SHA256 2f9caf33f2388f48e898cafc302f1cd4a1a0fe1671084024789e9c115f591305
MD5 2b2f4857603601dce68223d612626da6
SHA1 cf5ce605d6134a0ffbcdd8c570027a56dbd1a8d6
SHA512 4b883ecb1cda9428579d680de2dac83b9adbc53171e27455edf9d5f31cdeb754142c040ec51dd0e043bc296367b9e1b280d5fb3768d95d3c85c66922d891ee5f
SSDEEP 3072:H8zBh0hlIaQCqGBve9OYEQvTCMZJncSmZjW0YvrdPsDD5Zsv04UD4sL4/R:MBou5CqGB6SkTCQcFW0KTfXX
TLSH
T160542A5827E419B7D96E833C8083821DE2B6B910B722EBDF065A843D6D377C47977B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
accountaccessor.dll

File Explorer

accountaccessor.dll

.dll 296KB

accountaccessor.dll

IMPHASH 999f2fb14506086f562345dec38b10ac
SHA256 2f9caf33f2388f48e898cafc302f1cd4a1a0fe1671084024789e9c115f591305
MD5 2b2f4857603601dce68223d612626da6
SHA1 cf5ce605d6134a0ffbcdd8c570027a56dbd1a8d6
SHA512 4b883ecb1cda9428579d680de2dac83b9adbc53171e27455edf9d5f31cdeb754142c040ec51dd0e043bc296367b9e1b280d5fb3768d95d3c85c66922d891ee5f
SSDEEP 3072:H8zBh0hlIaQCqGBve9OYEQvTCMZJncSmZjW0YvrdPsDD5Zsv04UD4sL4/R:MBou5CqGB6SkTCQcFW0KTfXX
TLSH
T160542A5827E419B7D96E833C8083821DE2B6B910B722EBDF065A843D6D377C47977B06
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

AccountAccessor.pdb

msvcrt

_stricmp __CxxFrameHandler3 wcschr wcsstr iswspace _onexit __dllonexit _wcsnicmp realloc memset memcpy _vsnwprintf _unlock _lock _initterm _amsg_exit _XcptFilter _callnewh malloc free _purecall _strnicmp __C_specific_handler memcpy_s _wcsicmp wcscmp

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlReportException

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW GetModuleFileNameA FreeLibrary GetModuleHandleW GetProcAddress

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore OpenSemaphoreW CreateMutexExW CreateSemaphoreExW WaitForSingleObjectEx LeaveCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive DeleteCriticalSection WaitForSingleObject EnterCriticalSection ReleaseMutex InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree HeapAlloc GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken GetCurrentProcessId GetCurrentProcess OpenProcessToken TerminateProcess GetCurrentThread GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnlock BSTR_UserMarshal64 BSTR_UserSize64 BSTR_UserFree64 SafeArrayGetElemsize BSTR_UserUnmarshal BSTR_UserUnmarshal64 BSTR_UserFree BSTR_UserSize SysAllocStringLen SysStringLen SysAllocString SafeArrayDestroy SafeArrayGetDim BSTR_UserMarshal SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayCreate VarCmp VariantClear VariantInit VariantCopy SysFreeString

api-ms-win-eventing-provider-l1-1-0

EventUnregister EventWriteTransfer EventSetInformation EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SleepConditionVariableSRW Sleep

api-ms-win-core-registry-l1-1-0

RegGetValueW RegDeleteTreeW RegOpenKeyExW RegCloseKey RegFlushKey

api-ms-win-core-com-l1-1-0

CoCreateGuid StringFromGUID2 CoCreateInstance CoTaskMemFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime FileTimeToSystemTime

syncutil

CoCreateInstanceElevated ord31 ord242 ord290 ord39 ord94 ord257 SetDefaultStoreDirty MarkUserDataAccountAsHidden ord25 ord27 ord17 ord470 ord26 ord29 ord4 ord28 SetAuthCertHash DeleteAuthCertHash GetAuthCertHash DoesServerSupportAutoMoveSentItem ord308 GetDefaultDeviceType ord125 ord93 ord1 ord21 ord24 ord40 ord122 ord74 ord121 ord120 ord307 TryGetDefaultSignInAccountInfo GetGoldenPartnershipId ord296 ord87 ord109 DeletePwd ReleaseDataStoreLock ord23 ord255 ord112 ord475 ord111 ord95 ord10 DeleteOAuthRefreshTokenForPartnership WriteOAuthRefreshTokenForPartnership ord38 AcquireDataStoreLock ord131 ord130 ord132 ord133 ord134 ord135 ord71 ord118 ord3 ord119 ord108 ord2 InitializeMsaStore

mccsengineshared

GetDomainNamesForEmailSyncList IsDomainInDelimitedList GetAccountDomainForAccountAccessor

api-ms-win-security-base-l1-1-0

CopySid GetLengthSid GetTokenInformation

api-ms-win-core-threadpool-l1-2-0

DisassociateCurrentThreadFromCallback CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait WaitForThreadpoolWaitCallbacks

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

192KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

accountaccessor.dll

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

syncutil

mccsengineshared

api-ms-win-security-base-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic