wintrust[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

wintrust.dll
Size

172KB
MD5

b25d14dcbbb6623c1a63cd07a97df32b
SHA1

7bda19c92848a811077f780f569c0593d14b2a92
SHA256

0d47359062dd32a7cca3ea6e9716491e149698827d5e65a80579dd88ed0ffba4
SHA512

6cb19df2cf659fcbec931ced57acfa8cd816a336ab376eedca7dbeca0641e0dfb3bd3a703c77091002f8036e8e8c4acc4b7da3ea8ebce2baf05f2ba5ad017e5c
SSDEEP

3072:Od2CHwnMutz7qayNOEjim0HrP5koMEuhG+DkS1MaYO5sam7o1EXXFT421kxpb7K7:Od28wztvC0LRi1ju7ex

Score

N/A

Malware Config

Signatures

Files

wintrust.dll
.dll regsvr32 windows x86

393d55d7b8180365866be3731323e3a2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenThreadToken
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
QueryServiceStatus
StartServiceA
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceConfigA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
StartServiceW
CloseServiceHandle
EqualSid
CryptAcquireContextA
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegDeleteValueA
RegEnumValueW
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptSetProvParam
CryptReleaseContext
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
FreeSid
AllocateAndInitializeSid

crypt32

CryptEnumOIDInfo
I_CryptFreeLruCache
I_CryptCreateLruEntry
I_CryptReleaseLruEntry
I_CryptInsertLruEntry
I_CryptFindLruEntryData
I_CryptFlushLruCache
I_CryptCreateLruCache
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CryptMsgGetParam
CertGetNameStringW
CertSetCertificateContextProperty
CertCreateCertificateContext
CertOpenSystemStoreA
CryptExportPublicKeyInfo
CertRDNValueToStrW
CertFindRDNAttr
CryptSIPLoad
CryptSIPRetrieveSubjectGuid
CryptMsgUpdate
CryptMsgOpenToDecode
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgVerifyCountersignatureEncodedEx
CryptEncodeObjectEx
CertFindAttribute
CryptSIPRemoveProvider
CryptSIPAddProvider
CryptEncodeObject
CryptStringToBinaryW
CertAlgIdToOID
CryptSIPRetrieveSubjectGuidForCatalogFile
CertFindSubjectInSortedCTL
CertCreateContext
CryptMsgEncodeAndSignCTL
CryptMsgClose
CertOIDToAlgId
CertFindCertificateInStore
CertGetCertificateContextProperty
I_CryptReadTrustedPublisherDWORDValueFromRegistry
I_CryptGetDefaultCryptProv
CertGetIssuerCertificateFromStore
CertCompareCertificateName
CertCloseStore
CertCreateCertificateChainEngine
CertOpenStore
CertDuplicateStore
CertAddStoreToCollection
CertComparePublicKeyInfo
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetCertificateChain
CertGetEnhancedKeyUsage
CertFreeCTLContext
CertFreeCertificateContext
CertDuplicateCertificateContext
I_CryptGetAsn1Encoder
I_CryptGetAsn1Decoder
CryptRegisterOIDFunction
CryptUnregisterOIDFunction
I_CryptUninstallAsn1Module
I_CryptInstallAsn1Module
CertControlStore
CertVerifySubjectCertificateContext
CryptDecodeObject
CertCompareIntegerBlob
CertFindExtension
CertVerifyValidityNesting
CertVerifyTimeValidity

imagehlp

ImageEnumerateCertificates
ImageRemoveCertificate
ImageDirectoryEntryToData
ImageGetDigestStream
ImageAddCertificate
ImageGetCertificateData

kernel32

LocalReAlloc
WaitForMultipleObjects
GetCurrentThread
Sleep
OutputDebugStringA
GetLocalTime
SystemTimeToFileTime
GetLastError
lstrcmpA
SetLastError
SetEvent
DisableThreadLibraryCalls
lstrlenW
FreeLibrary
GetProcAddress
WideCharToMultiByte
ResetEvent
WaitForSingleObject
LoadLibraryA
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
lstrcpyA
ExpandEnvironmentStringsA
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalFree
LocalAlloc
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
WriteFile
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
GetFileSize
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ReleaseMutex
MoveFileA
DeleteFileA
MoveFileExW
UnregisterWaitEx
RegisterWaitForSingleObject
CreateEventA
GetCurrentDirectoryW
GetSystemDirectoryW
FindClose
CreateFileA
CreateFileW
DeleteFileW
CopyFileA
CopyFileW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryW
GetTempFileNameA
GetTempFileNameW
LoadLibraryW
ExpandEnvironmentStringsW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
CreateMutexA
CreateMutexW
CloseHandle

msasn1

ASN1_FreeEncoded
ASN1_SetEncoderOption
ASN1_Decode
ASN1_Encode
ASN1_FreeDecoded
ASN1Free
ASN1BERDecNotEndOfContents
ASN1DecRealloc
ASN1BERDecS32Val
ASN1BEREncS32
ASN1bitstring_free
ASN1BERDecBitString
ASN1bitstring_cmp
ASN1BEREncRemoveZeroBits
ASN1charstring_free
ASN1char16string_free
ASN1DecSetError
ASN1BERDecCharString
ASN1BERDecChar16String
ASN1BERDecOctetString2
ASN1BERDecExplicitTag
ASN1BERDecPeekTag
ASN1BERDecOpenType2
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncOpenType
ASN1BEREncEndOfContents
ASN1BERDecUTCTime
ASN1BERDecBool
ASN1BEREncBool
ASN1BERDecObjectIdentifier2
ASN1BEREncObjectIdentifier2
ASN1_CloseModule
ASN1_CreateModule
ASN1BEREncOctetString
ASN1BEREncBitString
ASN1BEREncChar16String
ASN1BEREncCharString
ASN1CEREncEndBlk
ASN1CEREncFlushBlkElement
ASN1CEREncNewBlkElement
ASN1CEREncBeginBlk
ASN1CEREncUTCTime

msvcrt

_onexit
__dllonexit
_adjust_fdiv
_initterm
wcslen
malloc
free
qsort
_stricmp
_ltoa
atol
_wcsnicmp
_itow
wcsrchr
_memicmp
wcstol
_strnicmp
vswprintf
wcschr
_wtol
towupper
_except_handler3
wcscmp
wcscpy
wcscat
_wcsicmp

rpcrt4

RpcStringFreeW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFree

user32

wsprintfA
wsprintfW
MessageBoxA
GetDesktopWindow

Exports

Exports

AddPersonalTrustDBPages
CatalogCompactHashDatabase
CryptCATAdminAcquireContext
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATAdminPauseServiceForBackup
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminRemoveCatalog
CryptCATAdminResolveCatalogPath
CryptCATCDFClose
CryptCATCDFEnumAttributes
CryptCATCDFEnumAttributesWithCDFTag
CryptCATCDFEnumCatAttributes
CryptCATCDFEnumMembers
CryptCATCDFEnumMembersByCDFTag
CryptCATCDFEnumMembersByCDFTagEx
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATClose
CryptCATEnumerateAttr
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATGetAttrInfo
CryptCATGetCatAttrInfo
CryptCATGetMemberInfo
CryptCATHandleFromStore
CryptCATOpen
CryptCATPersistStore
CryptCATPutAttrInfo
CryptCATPutCatAttrInfo
CryptCATPutMemberInfo
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptSIPCreateIndirectData
CryptSIPGetInfo
CryptSIPGetRegWorkingFlags
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPVerifyIndirectData
DllRegisterServer
DllUnregisterServer
DriverCleanupPolicy
DriverFinalPolicy
DriverInitializePolicy
FindCertsByIssuer
GenericChainCertificateTrust
GenericChainFinalProv
HTTPSCertificateTrust
HTTPSFinalProv
I_CryptCatAdminMigrateToNewCatDB
IsCatalogFile
MsCatConstructHashTag
MsCatFreeHashTag
OfficeCleanupPolicy
OfficeInitializePolicy
OpenPersonalTrustDBDialog
OpenPersonalTrustDBDialogEx
SoftpubAuthenticode
SoftpubCheckCert
SoftpubCleanup
SoftpubDefCertInit
SoftpubDllRegisterServer
SoftpubDllUnregisterServer
SoftpubDumpStructure
SoftpubFreeDefUsageCallData
SoftpubInitialize
SoftpubLoadDefUsageCallData
SoftpubLoadMessage
SoftpubLoadSignature
TrustDecode
TrustFindIssuerCertificate
TrustFreeDecode
TrustIsCertificateSelfSigned
TrustOpenStores
WTHelperCertCheckValidSignature
WTHelperCertFindIssuerCertificate
WTHelperCertIsSelfSigned
WTHelperCheckCertUsage
WTHelperGetAgencyInfo
WTHelperGetFileHandle
WTHelperGetFileHash
WTHelperGetFileName
WTHelperGetKnownUsages
WTHelperGetProvCertFromChain
WTHelperGetProvPrivateDataFromChain
WTHelperGetProvSignerFromChain
WTHelperIsInRootStore
WTHelperOpenKnownStores
WTHelperProvDataFromStateData
WVTAsn1CatMemberInfoDecode
WVTAsn1CatMemberInfoEncode
WVTAsn1CatNameValueDecode
WVTAsn1CatNameValueEncode
WVTAsn1SpcFinancialCriteriaInfoDecode
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcIndirectDataContentDecode
WVTAsn1SpcIndirectDataContentEncode
WVTAsn1SpcLinkDecode
WVTAsn1SpcLinkEncode
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
WVTAsn1SpcPeImageDataDecode
WVTAsn1SpcPeImageDataEncode
WVTAsn1SpcSigInfoDecode
WVTAsn1SpcSigInfoEncode
WVTAsn1SpcSpAgencyInfoDecode
WVTAsn1SpcSpAgencyInfoEncode
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcSpOpusInfoEncode
WVTAsn1SpcStatementTypeDecode
WVTAsn1SpcStatementTypeEncode
WinVerifyTrust
WinVerifyTrustEx
WintrustAddActionID
WintrustAddDefaultForUsage
WintrustCertificateTrust
WintrustGetDefaultForUsage
WintrustGetRegPolicyFlags
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustSetRegPolicyFlags
mscat32DllRegisterServer
mscat32DllUnregisterServer
mssip32DllRegisterServer
mssip32DllUnregisterServer

Sections

.text
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

393d55d7b8180365866be3731323e3a2

Headers

File Characteristics

Imports

advapi32

crypt32

imagehlp

kernel32

msasn1

msvcrt

rpcrt4

user32

Exports

Exports

Sections

.text Size: 161KB - Virtual size: 160KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 161KB - Virtual size: 160KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 5KB - Virtual size: 5KB