CertPolEng[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CertPolEng.dll
Size

134KB
MD5

ad5f019257d17f7c525109ffe020814c
SHA1

e2eb011d3d553498e046fb4bdc27fbe4a3e9703f
SHA256

4a63dc82108c59c3902ee5afb588d2096565cae682c117779e1e2620c06f3c03
SHA512

5f391c3a4509a2be4702054005f8ef487a0961d1257d88d64545590172604332aff5dd811ad35faca4c7a5786ea296fc5cd2b69e8a064be475087574b5a34c9e
SSDEEP

3072:0+7WjWrOcAmZNVq/wAMLDCftqplBSfTFw4d1zVsTfZcvbyI9:0bWrOeNVq/wH+FKOqO1zVsTfZcvby

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CertPolEng.dll

Files

CertPolEng.dll
.dll windows:10 windows x86 arch:x86

9ef0b1bea63afd38e937d1390728e9c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CertPolEng.pdb

Imports

msvcrt

memmove_s
_stricmp
memcmp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
_wcsicmp
_except_handler4_common
iswdigit
__CxxFrameHandler3
wcschr
_wcsnicmp
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-1-0

ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
CreateEventW
LeaveCriticalSection
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingBind
RpcBindingFromStringBindingW
RpcAsyncCancelCall
RpcBindingCreateW
RpcBindingFree
RpcStringBindingComposeW
RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcAsyncInitializeHandle
I_RpcMapWin32Status
NdrClientCall4
NdrAsyncClientCall
UuidEqual

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-1-0

CheckTokenMembership
FreeSid
CreateWellKnownSid
AllocateAndInitializeSid

crypt32

CertAddStoreToCollection
CryptDecodeObject
CertOpenStore
CertFreeCertificateContext
CertCompareCertificateName
CertCreateCertificateChainEngine
CertControlStore
CertRDNValueToStrW
CryptFindOIDInfo
CertCloseStore
CertFindExtension
CertFreeCertificateChainEngine
CertGetCertificateContextProperty
CertFreeCertificateChain
CryptDecodeObjectEx
CryptBinaryToStringW
CertDuplicateCertificateChain
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
CertRegisterSystemStore
CryptHashCertificate2
CertGetCertificateChain
CertGetNameStringW
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChainList
CertSelectCertificateChains
CertFindCertificateInStore
CertCreateCertificateContext

ncrypt

NCryptFreeObject

api-ms-win-core-registry-l1-1-0

RegUnLoadKeyW
RegGetValueW
RegLoadKeyW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l2-1-0

CharUpperBuffW

bcrypt

BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

cryptsp

CryptReleaseContext

ntdll

RtlLengthRequiredSid
EtwTraceMessage
EtwEventRegister
EtwEventSetInformation
EtwEventUnregister
RtlFreeUnicodeString
RtlEqualUnicodeString
RtlDowncaseUnicodeString
WinSqmAddToStream
WinSqmIsOptedIn
RtlInitUnicodeString
RtlAllocateHeap
RtlSubAuthoritySid
RtlEqualSid
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlDeleteResource
RtlInitializeResource
RtlGUIDFromString
RtlNtStatusToDosError
RtlFreeHeap
EtwEventWriteTransfer
RtlInitializeSid
RtlCreateUnicodeString

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

IntPstGetCertificate
IntPstGetNameIdentifierForCertificate
IntPstGetTrustAnchors
IntPstMapCertificateToProvider
IntPstMapUserCredsToProvider
IntPstValidate
PstAcquirePrivateKey
PstGetCertificateChain
PstGetCertificates
PstGetTrustAnchors
PstGetTrustAnchorsEx
PstGetUserNameForCertificate
PstMapCertificate
PstValidate

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ef0b1bea63afd38e937d1390728e9c8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

crypt32

ncrypt

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l2-1-0

bcrypt

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-obsolete-l1-2-0

cryptsp

ntdll

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 108KB - Virtual size: 107KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB