CrlSCI[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CrlSCI.dll
Size

3.0MB
MD5

2d9b856f2a33799a11727e04a5261721
SHA1

f3dc5fb3fe5f62e0c09d35516ba900edfa44fad2
SHA256

4d179e1b443c1469134c94888b7bedd70334265d766187a0c10f4a6b8d86207d
SHA512

99a40bcec8985d3a9d3fd633c45a58b0232345a18a52f43c9d14d836d66adf36d2c105bced89f4f7cdbea535c0168fcdd52fd8842c6f469019e860eefcc3fe8f
SSDEEP

98304:ftQXPcOLSrBuJr1bS3lSouoZBVUS2FaTT:f6Pch4JBWSouo6Fa

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

CrlSCI.dll
.dll windows x64

1ca5b23b075008a96556dbf8afa07502

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crlconfig

?GetUseProductAnalytics@ProductAnalytics@@YA_NXZ
?GetECommInterface@ECommIntegration@@YAPEAVIECommCore@1@XZ
?INIGetRegistryProductKey@@YA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetMessagingInterface@PCUIntegration@@YAPEAVIMessagingSystem@1@XZ

crlfeaturemanagement

?FeatureSet@FeatureManagement@@YAAEAVIFeatureSet@1@XZ
?CreateFeatureSet@FeatureManagement@@YAXW4FeatureSetType@1@@Z
?Enterprise_func@Corporate@Features@FeatureManagement@@YAAEAVWFeature@3@XZ
?MessagingForStandard_func@Entitlements@Features@FeatureManagement@@YAAEAVWFeature@3@XZ

crlplatform

??0?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??1?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_W@Z
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@AEBV01@@Z
?GetLength@?$CrlStringT@_W@CrlPlatform@@QEBAHXZ
?Compare@?$CrlStringT@_W@CrlPlatform@@QEBAHV?$CrlStringViewT@_W@2@W4CompareCase@2@@Z
?CompareNoCase@?$CrlStringT@_W@CrlPlatform@@QEBAHV?$CrlStringViewT@_W@2@@Z
??0?$CrlStringViewT@_W@CrlPlatform@@QEAA@AEBV?$CrlStringT@_W@1@@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@AEBV01@@Z
?IsEmpty@?$CrlStringT@_W@CrlPlatform@@QEBA_NXZ
??Y?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@AEBV01@@Z
??B?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@$$QEAV01@@Z
??$?H_W@CrlPlatform@@YA?AV?$CrlStringT@_W@0@V?$CrlStringViewT@_W@0@0@Z
??0?$CrlStringViewT@_W@CrlPlatform@@QEAA@PEB_W@Z

crlpref

?GetInstance@CAppPrefManager@@SAAEAV1@XZ

crlutf

?ToU16String@CrlUtf@@YA?AV?$basic_string@_SU?$char_traits@_S@std@@V?$allocator@_S@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z

crlutils

?Combine@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W0@Z
?Exists@File@SystemIO@@YA_NPEB_W@Z
??0WriteLock@@QEAA@AEAVThreadLock@@@Z
??1WriteLock@@QEAA@XZ
?RemoveCallback@SingletonLibrary@CrlUtils@@SAXVtype_index@std@@_K@Z
?GetEntryForType@SingletonLibrary@CrlUtils@@SAPEAV12@Vtype_index@std@@V?$function@$$A6AXAEAVSingletonLibrary@CrlUtils@@_N@Z@4@_NPEAV?$function@$$A6AXXZ@4@@Z
??1ThreadLock@@QEAA@XZ
??0ThreadLock@@QEAA@XZ
?NotifySingletonModuleUnloaded@SingletonLibrary@CrlUtils@@SAX_K@Z
??0BindStateBase@details@CrlUtils@@AEAA@P6AXXZP6AXPEBV012@@Z@Z
??1BindStateBase@details@CrlUtils@@AEAA@XZ
?Release@?$RefCounted@VBindStateBase@details@CrlUtils@@UBindStateBaseRefCountTraits@23@@CrlUtils@@QEBAXXZ
??1RepeatingCallbackBase@details@CrlUtils@@IEAA@XZ
??0RepeatingCallbackBase@details@CrlUtils@@IEAA@V?$comlike_ptr@VBindStateBase@details@CrlUtils@@@2@@Z
?GetMemento@RepeatingCallbackBase@details@CrlUtils@@QEBA?AVRepeatingCallbackMemento@3@XZ

crlutl

??0WUTLRegistry@@QEAA@PEB_WKH@Z
??1WUTLRegistry@@UEAA@XZ
?IsValid@WUTLRegistry@@QEAAJXZ
?GetValue@WUTLRegistry@@QEAAJPEB_WAEAV?$CrlStringT@_W@CrlPlatform@@@Z
?IsCDAEnterpriseAccessEnabled@CrlUtl@@YA_NXZ
?GetRegistrationInfo@RegistrationInfo@@YAAEAVIRegistrationInfo@1@XZ

crlxml

??0WXmlDoc@@QEAA@_N@Z
??1WXmlDoc@@UEAA@XZ
?LoadFromString@WXmlDoc@@QEAA_NPEB_W@Z
?CreateChild@WXmlNode@@QEAA?AV1@PEB_W0@Z
?GetRootNode@WXmlDoc@@QEAA?AVWXmlNode@@XZ
??1WXmlNode@@QEAA@XZ
?SetString@WXmlValueAccessor@@QEAAXPEB_W@Z
?Attribute@WXmlNode@@QEBA?AVWXmlValueAccessor@@PEB_W@Z
??1WXmlValueAccessor@@QEAA@XZ
?SaveToString@WXmlDoc@@QEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
??0WXmlNode@@QEAA@XZ
?GetNode@WXmlNode@@QEBA_NAEBVWXPath@@AEAV1@@Z
?IsValid@WXmlNode@@QEBA_NXZ
?GetString@WXmlValueAccessor@@QEBA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
??1WXPath@@QEAA@XZ
??0WXPath@@QEAA@PEB_W@Z

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ

mfc140u

ord266
ord1489
ord1491
ord265

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeCriticalSectionEx
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memcpy
memmove
__RTDynamicCast
__std_type_info_destroy_list
__std_terminate
__std_exception_copy
__std_exception_destroy
__std_type_info_compare
_purecall
memset
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_seh_filter_dll
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

_wtoi

user32

GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

?GetInst@IIPMMessagingSystem@CrlSCI@@SAAEAV12@XZ
?SetInstForTests@IIPMMessagingSystem@CrlSCI@@SAXPEAV12@@Z

Sections

.text
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ca5b23b075008a96556dbf8afa07502

Headers

DLL Characteristics

File Characteristics

Imports

crlconfig

crlfeaturemanagement

crlplatform

crlpref

crlutf

crlutils

crlutl

crlxml

msvcp140

mfc140u

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

user32

Exports

Exports

Sections

.text Size: - Virtual size: 32KB

.rdata Size: - Virtual size: 22KB

.data Size: - Virtual size: 4KB

.pdata Size: - Virtual size: 2KB

.vmp0 Size: - Virtual size: 1.4MB

.vmp1 Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 512B - Virtual size: 184B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 32KB

.rdata
Size: - Virtual size: 22KB

.data
Size: - Virtual size: 4KB

.pdata
Size: - Virtual size: 2KB

.vmp0
Size: - Virtual size: 1.4MB

.vmp1
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 512B - Virtual size: 184B

.rsrc
Size: 1KB - Virtual size: 1KB