crypttpmeksvc[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

crypttpmeksvc.dll
Size

65KB
MD5

204e4ad213bad1c2a76cacb12b16128f
SHA1

8a47540362e051af2d404d41568c4ac58e5f4eb3
SHA256

663d04dc70a1af2f6bcfd3cff66922f108d8f1efab0d1837f2876f159c787e23
SHA512

0bdb42dbbc3bd3b839724cf3776d4fbb6a4e37cddf3d6b91971bd5b4a8b485a88113f5959a172bbaa18606d656683e973bac3f46ea1a6a481ecfa8698fd40065
SSDEEP

1536:dsV/ybdmFhDPo+YOaz0/qJ1XMJ5yOgeNcb:U/CdAPov7zrJ1XSdg0c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crypttpmeksvc.dll

Files

crypttpmeksvc.dll
.dll windows:10 windows x86 arch:x86

d1c2a0362ace76325c388dabf778de4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

crypttpmeksvc.pdb

Imports

msvcrt

_lock
free
_amsg_exit
_XcptFilter
memmove_s
_purecall
_unlock
_wcsicmp
memcpy_s
strrchr
__dllonexit
_initterm
_except_handler4_common
memcmp
memcpy
strchr
fprintf
fseek
_vsnprintf
malloc
fflush
_vsnwprintf
fopen
_onexit
memset

crypt32

CertDuplicateCertificateContext
CertNameToStrW
CryptExportPublicKeyInfo
CertFindExtension
CertEnumCertificatesInStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CryptEncodeObjectEx
CryptBinaryToStringW
CertGetEnhancedKeyUsage
CryptMsgGetAndVerifySigner
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateContext
CertCompareCertificate
CryptFormatObject
CertFindCertificateInStore
CryptFindOIDInfo
CertOpenStore
CryptEncryptMessage
CryptMsgGetParam
CertCloseStore
CryptSignMessage
CryptDecodeObjectEx
CryptMsgClose
CryptMsgUpdate
CertFreeCertificateChain
CryptMsgOpenToDecode
CertGetCertificateContextProperty

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW

rpcrt4

I_RpcBindingIsClientLocal
NdrServerCall2
RpcServerRegisterIf3
RpcServerUnregisterIf

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseSemaphore
ReleaseSRWLockShared
DeleteCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
LeaveCriticalSection
AcquireSRWLockExclusive
CreateMutexExW
EnterCriticalSection
AcquireSRWLockShared
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

oleaut32

VariantClear
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantInit

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoSetProxyBlanket

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CryptsvcDllCtrl
EKCliAuthorityKeyGetInfo
EKCliTpmEndorsementKeyDecryptSCEPChallenge
EKCliTpmEndorsementKeyGetInfo
EKCliTpmGetManufacturerInfo
FreeCMCResponse
IsCmcResponseForAttestation
ParseCMCResponse

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1c2a0362ace76325c388dabf778de4b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

crypt32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-debug-l1-1-0

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

oleaut32

api-ms-win-core-com-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 53KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 54KB - Virtual size: 53KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB