CertEnroll[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CertEnroll.dll
Size

2.8MB
MD5

1862d41864bb4fcd591454db7292292e
SHA1

1b1047550a41b0a1281dac168c487825417d15bc
SHA256

11763ddc78227cd44d779ca1e8daa95e6b4598adfcee23964fb0968010a6f731
SHA512

ea0787e5bf481ce834db7c47e2102049f5f88e09534cad4eef3d4a51ca281f6037e3e60961f933f6ee1af8c2b9827f98f168ef78fc8c232c5991bbee8fd7035d
SSDEEP

49152:qOEHmuo0RYuuvqKzqiRVoQhOtMTyCW7GryZkeOIsKhiDJJ/K:qno0IqKbRCQ4tMTI7GrokpIs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CertEnroll.dll

Files

CertEnroll.dll
.dll regsvr32 windows:10 windows x86 arch:x86

70a0e25a3e66dbc82ac8db9b9b12940c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CertEnroll.pdb

Imports

msvcrt

rand
_stricmp
wcschr
srand
wcsstr
qsort
wcsrchr
calloc
__isascii
ispunct
_vsnprintf_s
_callnewh
memcpy
memcmp
_wcsnicmp
_CIpow
__iob_func
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_itow
_wtoi
_except_handler4_common
??1type_info@@UAE@XZ
_lock
_unlock
__dllonexit
iswdigit
?what@exception@@UBEPBDXZ
_ftol2_sse
_onexit
_wcsicmp
_purecall
wcscat_s
wcscpy_s
malloc
wcsncpy_s
??0exception@@QAE@ABQBD@Z
_vsnwprintf
free
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
memmove_s
memcpy_s
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strcspn
fprintf
wcscspn
fflush
fclose
fopen
_wgetenv
fseek
ftell
fwrite
iswalpha
strchr
getenv
_vsnprintf
iswxdigit
iswspace
wcsncmp
isdigit
atoi
strncmp
fputws
ferror
_wfopen_s
fwprintf
vfwprintf
towlower
iswupper
iswlower
towupper
_strnicmp
bsearch
_errno
realloc
memmove
__CxxFrameHandler3
memset

certca

ord449
ord436
ord453
ord845
ord450
ord444
ord454
ord847
ord442
ord703
ord430
ord844
ord416
ord435
ord843
ord413
ord823
ord820
ord414
ord445
ord457
ord460
ord801
ord462
ord479
ord819
ord813
ord808
ord420
ord486
ord467
ord446
ord842
ord705
ord841
ord405
ord838
ord824
ord839
ord452
ord458
ord456
ord438
ord846
ord404
ord707
ord840
ord455
ord487
ord602
ord809
ord601
ord704
ord440
ord468
ord869
ord412
ord485
ord434
ord802

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateEventExW
ReleaseMutex
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
SetEvent
ReleaseSRWLockShared
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockShared
AcquireSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-libraryloader-l1-2-0

LockResource
GetProcAddress
LoadResource
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
DisableThreadLibraryCalls
FindResourceExW
SizeofResource
LoadStringW
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegUnLoadKeyW
RegQueryValueExW
RegGetValueW
RegDeleteKeyExW
RegEnumKeyExW
RegLoadKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegOpenCurrentUser
RegSetValueExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerW

api-ms-win-core-string-l1-1-0

CompareStringEx
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
CompareStringW
FoldStringW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemTime
GetComputerNameExW
GetLocalTime
GetSystemDirectoryW
GetSystemTimeAsFileTime

crypt32

CertGetIssuerCertificateFromStore
CryptMsgClose
CertGetNameStringW
CertCreateCRLContext
CertSerializeCertificateStoreElement
PFXImportCertStore
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToEncode
CryptHashPublicKeyInfo
CertEnumCertificateContextProperties
CryptHashCertificate2
CertFindExtension
CryptEncryptMessage
CertSaveStore
CryptQueryObject
CertFindAttribute
CryptVerifyCertificateSignature
CryptDecodeObjectEx
CryptMsgGetAndVerifySigner
CertCreateCertificateContext
CertGetEnhancedKeyUsage
CertNameToStrW
CertGetPublicKeyLength
CryptVerifyCertificateSignatureEx
CryptFindOIDInfo
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertFindCertificateInStore
CryptVerifyMessageSignature
CryptMsgCalculateEncodedLength
CryptMsgDuplicate
CryptMemFree
CryptVerifyTimeStampSignature
CryptUnprotectMemory
CryptProtectMemory
CertAddSerializedElementToStore
CertFreeCertificateChainList
CertSelectCertificateChains
CryptImportPublicKeyInfoEx2
CryptBinaryToStringW
CertVerifySubjectCertificateContext
CertControlStore
CertAddCertificateLinkToStore
CertAddEncodedCertificateToStore
PFXExportCertStoreEx
CertDeleteCertificateFromStore
CryptHashCertificate
CertDuplicateCertificateContext
CertFindCTLInStore
CertRegisterPhysicalStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey
CertComparePublicKeyInfo
CryptExportPKCS8
CertFreeCertificateChain
CryptImportPublicKeyInfo
CertGetIntendedKeyUsage
CertStrToNameW
PFXIsPFXBlob
CryptDecryptMessage
CryptSignMessage
CryptFormatObject
CryptStringToBinaryW
CertVerifyCertificateChainPolicy
CryptRegisterOIDInfo
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptMsgOpenToDecode
CertGetCRLContextProperty
CertGetCertificateChain
CryptSignCertificate
CryptExportPublicKeyInfoEx
CryptEncodeObjectEx
CertDuplicateStore
CertOpenStore
CryptProtectData
CryptDecodeObject
CryptEnumOIDInfo
CertSetCertificateContextProperty
CertFreeCRLContext

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
GetFileTime
CreateDirectoryW
FileTimeToLocalFileTime
WriteFile
GetTempFileNameW
SetFilePointer
GetFullPathNameW
SetEndOfFile
CreateFileW
CompareFileTime
FindFirstFileW
DeleteFileW
GetFileSize
FindClose
FindNextFileW
GetFileType

api-ms-win-core-localization-l1-2-0

GetACP
GetLocaleInfoW
FormatMessageW
IdnToUnicode
IdnToAscii

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetEnvironmentVariableW
ExpandEnvironmentStringsW
SearchPathW
GetCommandLineW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
FreeSid
GetLengthSid
ImpersonateLoggedOnUser
RevertToSelf
IsValidSecurityDescriptor
GetSecurityDescriptorLength
CopySid
GetTokenInformation
EqualSid
CreateWellKnownSid
DuplicateTokenEx
SetSecurityDescriptorControl

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-processthreads-l1-1-0

GetProcessId
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetCurrentProcess
CreateThread

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CallbackMayRunLong
CreateThreadpoolTimer
CloseThreadpoolTimer
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback

dsparse

DsGetRdnW

rpcrt4

NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
UuidCreate
CStdStubBuffer_CountRefs
UuidToStringW
RpcStringFreeW
UuidFromStringW
UuidIsNil
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleFree
NdrClientCall4
RpcBindingFree
RpcEpResolveBinding
RpcStringBindingComposeW
RpcBindingFromStringBindingW
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
RpcBindingSetAuthInfoExW
CStdStubBuffer_IsIIDSupported
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
IUnknown_QueryInterface_Proxy
RpcExceptionFilter

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction3
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient9
ObjectStublessClient12
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient3
ObjectStublessClient22
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient21
ObjectStublessClient14
CStdStubBuffer2_Connect

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW
GetTimeFormatA
GetDateFormatA

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-url-l1-1-0

UrlGetPartW

api-ms-win-security-activedirectoryclient-l1-1-0

DsUnBindW

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-security-logon-l1-1-0

LogonUserExW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

ntdll

RtlCapabilityCheck
RtlCheckTokenMembershipEx
RtlCheckTokenMembership
RtlSubAuthoritySid
RtlInitializeSid
RtlGetPersistedStateLocation
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlCheckTokenCapability
NtQueryInformationToken
WinSqmIncrementDWORD
WinSqmSetString
RtlInitUnicodeString
NtQuerySystemInformationEx
EtwTraceMessage
RtlNtStatusToDosError
EtwEventWriteFull
EtwEventUnregister
EtwEventRegister
RtlEqualSid

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CreateLogonCertificateRequest
DeleteLogonCertificateRequest
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
ImportPFXToProvider
ImportPFXToProviderFreeData
InstallLogonCertificateResponse
IsLogonCertificateTemplateAvailable
LogCertArchive
LogCertCopy
LogCertDelete
LogCertExpire
LogCertExport
LogCertImport
LogCertInstall
LogCertReplace
UpdateMachinePolicyConfigurationForTemplate

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70a0e25a3e66dbc82ac8db9b9b12940c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

certca

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

crypt32

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-l1-2-0

dsparse

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-localization-l1-2-2

api-ms-win-core-url-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-security-logon-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.data Size: 14KB - Virtual size: 19KB

.idata Size: 15KB - Virtual size: 15KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 223KB - Virtual size: 222KB

.reloc Size: 164KB - Virtual size: 163KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 14KB - Virtual size: 19KB

.idata
Size: 15KB - Virtual size: 15KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 223KB - Virtual size: 222KB

.reloc
Size: 164KB - Virtual size: 163KB