SmiProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SmiProvider.dll
Size

246KB
MD5

ad7bbb62335f6dc36214d8c9fe1aaca0
SHA1

f03cb2db64c361d47a1c21f6d714e090d695b776
SHA256

ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
SHA512

4ad7132f0ad5a7228ec116c28d23ee9acfdbf4adf535b0b9995f2e7eec8776e652a0a18539c02b6f4b3e0c8fa2f75d5181577dec16993fa55cb971d7e82faac5
SSDEEP

6144:43ur8J+YA8/n0ohAKawrmTt8xANEyQMyQO:eur8Jb5n0DKawqFryv

Score

1^/10

Malware Config

Signatures

Files

SmiProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

afe5266be53f5dbce007edb1ee8b1746

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:b3:94:2f:a8:06:5c:4e:49:4b:b8:22:7e:92:45:7c:54:00:c5:a6:90:da:d5:86:a2:f1:0d:5d:30:22:58:8d
Signer

Actual PE Digest

4f:b3:94:2f:a8:06:5c:4e:49:4b:b8:22:7e:92:45:7c:54:00:c5:a6:90:da:d5:86:a2:f1:0d:5d:30:22:58:8d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

msvcrt

_vsnprintf
_wcsicmp
wcsstr
_wcsnicmp
_onexit
__dllonexit
_wcslwr_s
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
memmove_s
_vsnwprintf
_purecall
vswprintf_s
_vscwprintf
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
wcschr
iswspace
_unlock
__CxxFrameHandler3
__C_specific_handler
towupper
memcpy
memcmp
memset

advapi32

AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegFlushKey
RegUnLoadKeyW
RegLoadKeyW
LookupPrivilegeValueW

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
HeapFree
GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetThreadLocale
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetThreadLocale
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
SetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
DeleteCriticalSection
GetFileAttributesW
CreateFileW
SetFilePointer
GetFullPathNameW
ReadFile
CloseHandle
GetCurrentProcess
DebugBreak

ole32

CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

user32

CharNextW

oleaut32

SysFreeString
VarUI4FromStr
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
LoadRegTypeLi

rpcrt4

I_RpcMapWin32Status
UuidCreate

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus
NtSetInformationFile
RtlInitUnicodeString
NtWriteFile
NtReadFile
RtlReAllocateHeap
RtlExpandEnvironmentStrings
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
RtlRaiseStatus
NtYieldExecution
RtlNtStatusToDosError
NtClose

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afe5266be53f5dbce007edb1ee8b1746

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

4f:b3:94:2f:a8:06:5c:4e:49:4b:b8:22:7e:92:45:7c:54:00:c5:a6:90:da:d5:86:a2:f1:0d:5d:30:22:58:8dSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

user32

oleaut32

rpcrt4

ntdll

Exports

Exports

Sections

.text Size: 169KB - Virtual size: 169KB

.rdata Size: 53KB - Virtual size: 52KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

4f:b3:94:2f:a8:06:5c:4e:49:4b:b8:22:7e:92:45:7c:54:00:c5:a6:90:da:d5:86:a2:f1:0d:5d:30:22:58:8d
Signer

.text
Size: 169KB - Virtual size: 169KB

.rdata
Size: 53KB - Virtual size: 52KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB