CbsProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CbsProvider.dll
Size

875KB
MD5

6ad0376a375e747e66f29fb7877da7d0
SHA1

a0de5966453ff2c899f00f165bbff50214b5ea39
SHA256

4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
SHA512

8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18
SSDEEP

12288:kqe4tO+jP4PZxP2gv4MefWfN3bGJ0mqs7xBU99l7gghi000U:ko4+UP3P2pMefWfN3bGJpv7QLl7hi0M

Score

1^/10

Malware Config

Signatures

Files

CbsProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

0f45fbefb8b1781c0744d3eb5e9d8acf

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:39:ec:a6:75:66:99:03:36:54:98:28:ea:a0:ac:92:61:e3:94:04:46:55:30:ba:34:26:eb:ca:17:71:88:0b
Signer

Actual PE Digest

26:39:ec:a6:75:66:99:03:36:54:98:28:ea:a0:ac:92:61:e3:94:04:46:55:30:ba:34:26:eb:ca:17:71:88:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

msvcrt

wcsstr
_wcsnicmp
iswspace
wcstoul
_vsnwprintf
__CxxFrameHandler3
_ultow_s
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_wcslwr_s
wcsrchr
_wtoi64
??0exception@@QEAA@XZ
_wtoi
iswdigit
malloc
calloc
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
wcschr
vswprintf_s
_vscwprintf
_wcstoui64
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_amsg_exit
memcpy
memcmp
__RTDynamicCast
memset

advapi32

RegDeleteKeyExW
RegEnumValueW
RegFlushKey
RegEnumKeyExW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
InitializeAcl
RegDeleteKeyW
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegUnLoadKeyW
RegQueryValueExW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

SetErrorMode
GetTempPathW
GetErrorMode
RemoveDirectoryW
ReadFile
SetFilePointer
GetFileInformationByHandleEx
SetLastError
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
GetCurrentDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
GetVersionExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
SetThreadUILanguage
FreeLibrary
GetFileAttributesW
CompareStringW
HeapFree
GetProcessHeap
GetCurrentProcess
CloseHandle
LoadLibraryW
CopyFileW
Sleep
DeleteFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateEventW
SetEvent
GetFullPathNameW
SetEnvironmentVariableW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
LocalFree
FormatMessageW
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
CreateFileW
LoadLibraryExW
GetEnvironmentVariableW
CreateDirectoryW
GetFileInformationByHandle
FindFirstFileW
FindNextFileW
FindClose
ExpandEnvironmentStringsW
GetTimeFormatEx
GetDateFormatEx
GetSystemInfo
GetModuleHandleExW
IsWow64Process

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoCreateGuid
CoGetMalloc

user32

LoadStringW
CharLowerBuffW
CharNextW

oleaut32

SetErrorInfo
SysStringByteLen
SysStringLen
SysAllocStringLen
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
CreateErrorInfo
VarBstrCmp
LoadRegTypeLi
VariantClear
VarBstrCat
GetErrorInfo
RegisterTypeLi
SysAllocStringByteLen

version

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

ntdll

RtlGetVersion
NtWriteFile
RtlInitUnicodeString
NtReadFile
RtlReAllocateHeap
NtClose
RtlAllocateHeap
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
RtlRaiseStatus
NtYieldExecution
RtlExpandEnvironmentStrings
RtlNtStatusToDosError
NtSetInformationFile
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 526KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f45fbefb8b1781c0744d3eb5e9d8acf

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

26:39:ec:a6:75:66:99:03:36:54:98:28:ea:a0:ac:92:61:e3:94:04:46:55:30:ba:34:26:eb:ca:17:71:88:0bSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

user32

oleaut32

version

ntdll

Exports

Exports

Sections

.text Size: 526KB - Virtual size: 525KB

.rdata Size: 245KB - Virtual size: 245KB

.data Size: 21KB - Virtual size: 22KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 55KB - Virtual size: 55KB

.reloc Size: 3KB - Virtual size: 3KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

26:39:ec:a6:75:66:99:03:36:54:98:28:ea:a0:ac:92:61:e3:94:04:46:55:30:ba:34:26:eb:ca:17:71:88:0b
Signer

.text
Size: 526KB - Virtual size: 525KB

.rdata
Size: 245KB - Virtual size: 245KB

.data
Size: 21KB - Virtual size: 22KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 55KB - Virtual size: 55KB

.reloc
Size: 3KB - Virtual size: 3KB