CredProvHelper[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CredProvHelper.dll
Size

64KB
MD5

04a343d2520a469a22e6fc6975e87e73
SHA1

2cb84606dabc7fe98714f41cc841332603a79753
SHA256

d54cd6f86a57de08d70ff7e972f8689a5e871a84a923c1730bf8de570a91824b
SHA512

ed330ed4602171602466e2c913661c6c51023d1b01ffcb2380978ff4546e5a14e83412fe357a32b9077d47ea5d94e124fdf14ed76b1614a2c02c5017435e9246
SSDEEP

1536:H+rK5GWIJqi7w+yPEzvz0wWcgJ7LJrePojh2WYsemLSvQ1:H+riIdw+pbNUJ7qWYbvY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CredProvHelper.dll

Files

CredProvHelper.dll
.dll windows:10 windows x86 arch:x86

ea47887a343cc9af4032ec0909f613d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CredProvHelper.pdb

Imports

msvcrt

_unlock
_lock
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
__dllonexit
?what@exception@@UBEPBDXZ
memcmp
__CxxFrameHandler3
_except_handler4_common
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??1type_info@@UAE@XZ
_onexit
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
memmove_s
_vsnwprintf
_CxxThrowException
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
OpenSemaphoreW
DeleteCriticalSection
CreateMutexExW
ReleaseMutex
LeaveCriticalSection
CreateSemaphoreExW
WaitForSingleObject
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseSRWLockShared
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl
EventUnregister

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

ntdll

RtlUnhandledExceptionFilter
NtTerminateProcess
RtlIsMultiUsersInSessionSku
RtlIsMultiSessionSku

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea47887a343cc9af4032ec0909f613d8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsalookup-l1-1-2

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 36B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 53KB - Virtual size: 53KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 36B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB