bcrypt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bcrypt.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bcrypt.dll
Resource
win10v2004-20240508-en
General
-
Target
bcrypt.dll
-
Size
80KB
-
MD5
167d953b7ca1f3869e1fb8e073770baa
-
SHA1
61f9821f24920a8f1edcc059827883c1160cf550
-
SHA256
728ed5611365eaa5251b5c661451bdc41554162bf2060c26fc1ef1de0151a8bd
-
SHA512
fe5545d9d2a3fcbf2ba657d30a37c7190db0baf3b4d6d8a3bf0d29cd2df68286d26493b0d458fe385aab1e48e81247d2d088228e4f4d82122a10ebb20812a361
-
SSDEEP
1536:nFIl4Utf1629jaZrfcQpa87dajAYXIMAEngVsAF394Iv0D:nFwlaZr37dajANMAEgVxUIv0D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcrypt.dll
Files
-
bcrypt.dll.dll windows:6 windows x86 arch:x86
48bd92dc3aa679ca3d08e50abfe5fc6a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
RtlUnwind
RtlAllocateHeap
RtlDeleteCriticalSection
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlInitializeResource
RtlAcquireResourceShared
_wcsicmp
RtlCompareUnicodeString
RtlImageNtHeader
_alloca_probe
NtDeviceIoControlFile
NtOpenFile
RtlNtStatusToDosError
NtClose
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
RtlUnhandledExceptionFilter
NtTerminateProcess
LdrDisableThreadCalloutsForDll
memset
RtlFreeHeap
memcpy
kernel32
HeapAlloc
GetModuleHandleW
GetProcessHeap
HeapFree
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
GetVersion
LocalFree
GetSystemWow64DirectoryW
GetProcAddress
InterlockedCompareExchange
FreeLibrary
SetLastError
CloseHandle
GetLastError
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
UnregisterWaitEx
InterlockedExchange
RegisterWaitForSingleObject
GetCurrentProcess
GetSystemDirectoryW
LocalAlloc
LoadLibraryW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
api-ms-win-security-base-l1-1-0
PrivilegeCheck
Exports
Exports
BCryptAddContextFunction
BCryptAddContextFunctionProvider
BCryptCloseAlgorithmProvider
BCryptConfigureContext
BCryptConfigureContextFunction
BCryptCreateContext
BCryptCreateHash
BCryptDecrypt
BCryptDeleteContext
BCryptDeriveKey
BCryptDeriveKeyCapi
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptDuplicateHash
BCryptDuplicateKey
BCryptEncrypt
BCryptEnumAlgorithms
BCryptEnumContextFunctionProviders
BCryptEnumContextFunctions
BCryptEnumContexts
BCryptEnumProviders
BCryptEnumRegisteredProviders
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptFreeBuffer
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptGetFipsAlgorithmMode
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptQueryContextConfiguration
BCryptQueryContextFunctionConfiguration
BCryptQueryContextFunctionProperty
BCryptQueryProviderRegistration
BCryptRegisterConfigChangeNotify
BCryptRegisterProvider
BCryptRemoveContextFunction
BCryptRemoveContextFunctionProvider
BCryptResolveProviders
BCryptSecretAgreement
BCryptSetAuditingInterface
BCryptSetContextFunctionProperty
BCryptSetProperty
BCryptSignHash
BCryptUnregisterConfigChangeNotify
BCryptUnregisterProvider
BCryptVerifySignature
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ