cryptnet[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cryptnet.dll
Size

141KB
MD5

add74cf40b20edff139fd2bc453ab469
SHA1

98b81a3f34d2f0908d568ad76e07b4fdfd7f3ab9
SHA256

cd70236c71810649f87ce75cf3ee1eb280f6817ea7bfc59f92464bf9b9d9be8f
SHA512

8de467f859af716634a36dc42a24f9bec4e2bb76fbe992d246a6dad9e374f980ce5ea8d8652a7ec72fb8a4411f2ed5fff11182425eb9972f81e923d7e5932063
SSDEEP

3072:GX1ZHgZcgIPlaYrGM8XpYD9AFW4nrdq7ULJr0rMi/8Hj+6iII/Os986S:XYrvWu9AFW4nrkALJrLi/8HjXih/ONv

Score

1^/10

Malware Config

Signatures

Files

cryptnet.dll
.dll regsvr32 windows:10 windows x86 arch:x86

48b3f0ce55cf2acd2816b096a92f2f12

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:5a:12:e3:5a:d5:59:b0:d5:de:bf:fa:ba:0a:af:88:12:6a:98:4a:c2:52:3a:c3:c5:5b:78:ce:30:76:31:f6
Signer

Actual PE Digest

1d:5a:12:e3:5a:d5:59:b0:d5:de:bf:fa:ba:0a:af:88:12:6a:98:4a:c2:52:3a:c3:c5:5b:78:ce:30:76:31:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptnet.pdb

Imports

msvcrt

free
malloc
_amsg_exit
_except_handler4_common
wcstok
_XcptFilter
memmove
memcmp
memcpy
_initterm
atol
printf
memset

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA
ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
OpenThread
TerminateProcess
ExitThread
GetCurrentProcess
ResumeThread
CreateThread
SetThreadToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLocalTime
GetSystemTime
GetTickCount

crypt32

CertGetCTLContextProperty
CertSetCRLContextProperty
CertEnumCertificatesInStore
CertAddEncodedCertificateToStore
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertDuplicateStore
CertAddStoreToCollection
CryptVerifyCertificateSignatureEx
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CertNameToStrW
I_CertChainEngineIsDisallowedCertificate
CertCreateCRLContext
CryptSignAndEncodeCertificate
I_CryptDetachTls
I_CryptFreeTls
I_CryptAllocTls
I_CryptSetTls
I_CryptCreateLruEntry
I_CryptFlushLruCache
I_CryptEnumMatchingLruEntries
CertCloseStore
CryptEncodeObjectEx
I_CryptReleaseLruEntry
I_CryptGetLruEntryData
CertFindCTLInStore
CertDuplicateCTLContext
CertFindSubjectInCTL
CertFreeCTLContext
CertDuplicateCertificateContext
CertFreeCertificateContext
CryptBinaryToStringW
I_CryptFindLruEntry
CertOpenStore
I_CryptTouchLruEntry
CryptMsgGetAndVerifySigner
CertAddCTLContextToStore
CertFindExtension
CertFreeCRLContext
CertFindCertificateInCRL
CertDuplicateCRLContext
CryptHashCertificate
CertGetCertificateContextProperty
CertFindCRLInStore
CertIsValidCRLForCertificate
CryptDecodeObject
CryptDecodeObjectEx
CertGetIssuerCertificateFromStore
CertCompareCertificateName
I_CryptRemoveLruEntry
I_CryptInsertLruEntry
I_CryptFreeLruCache
I_CryptCreateLruCache
I_CryptGetTls
I_CertUpdateStore
I_CertDiagControl
CryptMsgGetParam
CryptUnregisterOIDFunction
CryptMemAlloc
CryptMemFree
CryptUnregisterDefaultOIDFunction
CryptRegisterOIDFunction
CryptRegisterDefaultOIDFunction
CryptInstallOIDFunctionAddress
CertGetCRLContextProperty
CryptInitOIDFunctionSet
CryptMsgControl
CertEnumCTLsInStore
CertEnumCRLsInStore
CertFindCertificateInStore
CertGetCRLFromStore
CertDeleteCertificateFromStore
CertDeleteCRLFromStore
CertDeleteCTLFromStore
CryptQueryObject
CryptMemRealloc
CryptGetOIDFunctionAddress
CryptFreeOIDFunctionAddress
CertSetCertificateContextProperty
CryptGetOIDFunctionValue
CryptStringToBinaryW

api-ms-win-core-file-l1-1-0

SetFileAttributesW
FindClose
CreateDirectoryW
WriteFile
SetFilePointer
CreateFileW
FindNextFileW
ReadFile
DeleteFileW
GetFileSize
GetFileAttributesExW
CompareFileTime
GetFileAttributesW
FindFirstFileW
SetEndOfFile

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
SetEvent
WaitForMultipleObjectsEx
InitializeSRWLock
AcquireSRWLockShared
CreateEventA
InitializeCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
GetProcAddress

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-localization-l1-2-0

IdnToUnicode
IdnToAscii
FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CreateThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolWork

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatA

api-ms-win-security-base-l1-1-0

GetFileSecurityW
GetSecurityDescriptorSacl
GetAce
SetFileSecurityW
FreeSid
GetTokenInformation
AllocateAndInitializeSid
RevertToSelf
ImpersonateSelf
EqualSid

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-url-l1-1-0

UrlGetPartW
UrlEscapeW
UrlUnescapeW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

ntdll

wcstoul
_ultow
_ltoa
_wtol
iswalnum
wcsncmp
strrchr
EtwEventUnregister
EvtIntReportEventAndSourceAsync
EtwEventRegister
MD5Final
MD5Update
MD5Init
_vsnwprintf
_vsnprintf
wcsstr
wcschr
wcsncat_s
wcsncpy_s
wcsnlen
wcsrchr

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

Exports

Exports

CertDllVerifyCTLUsage
CertDllVerifyRevocation
CryptCancelAsyncRetrieval
CryptFlushTimeValidObject
CryptGetObjectUrl
CryptGetTimeValidObject
CryptInstallCancelRetrieval
CryptRetrieveObjectByUrlA
CryptRetrieveObjectByUrlW
CryptUninstallCancelRetrieval
DllRegisterServer
DllUnregisterServer
I_CryptConvertIriToAsciiOrUnicode
I_CryptConvertIriToAsciiOrUnicodeWithFlags
I_CryptNetAutoFlush
I_CryptNetEnumUrlCacheEntry
I_CryptNetFlushOfflineUrl
I_CryptNetGetConnectivity
I_CryptNetGetHostNameFromUrl
I_CryptNetGetUserDsStoreUrl
I_CryptNetSetUrlCacheFlushInfo
I_CryptNetSetUrlCachePreFetchInfo
LdapProvOpenStore

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48b3f0ce55cf2acd2816b096a92f2f12

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

1d:5a:12:e3:5a:d5:59:b0:d5:de:bf:fa:ba:0a:af:88:12:6a:98:4a:c2:52:3a:c3:c5:5b:78:ce:30:76:31:f6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

crypt32

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

ntdll

api-ms-win-security-base-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

Exports

Exports

Sections

.text Size: 114KB - Virtual size: 113KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 184B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

1d:5a:12:e3:5a:d5:59:b0:d5:de:bf:fa:ba:0a:af:88:12:6a:98:4a:c2:52:3a:c3:c5:5b:78:ce:30:76:31:f6
Signer

.text
Size: 114KB - Virtual size: 113KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 184B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB