cryptsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cryptsvc.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cryptsvc.dll
Resource
win10v2004-20240508-en
General
-
Target
cryptsvc.dll
-
Size
143KB
-
MD5
bf35d7826b82a863a0f65acb57746f0a
-
SHA1
4e395fb6e7975582fc6ef4b481efb3103c44337e
-
SHA256
d7e2aa54cc499373129bf04c7d54cf854eb7626b843d202c7866611d04c69c10
-
SHA512
6f96d8d2be7d28c3fc24222fe3e24e4c38b72d0713037e9b9594db604cff74d0b20f373cf1742a64ec600202172cec264ef807cb42f67db946076b6d490ed66d
-
SSDEEP
3072:/mhRBmHJAGPuEn+TAI2GonngZ6Twtol6Oc88jxA43mdFk:/mhRBmqGPuEnwx+rTwiW8rSIk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cryptsvc.dll
Files
-
cryptsvc.dll.dll windows:6 windows x86 arch:x86
06eedfefd5673c7bc65274272d0f923f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-security-base-l1-1-0
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AccessCheck
MapGenericMask
GetFileSecurityW
EqualSid
GetAce
GetSecurityDescriptorDacl
GetTokenInformation
DuplicateTokenEx
GetLengthSid
CopySid
GetSecurityDescriptorSacl
SetFileSecurityW
GetKernelObjectSecurity
AdjustTokenPrivileges
IsValidSecurityDescriptor
msvcrt
_resetstkoflw
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnprintf
_wcslwr
wcsstr
wcsncmp
_purecall
wcschr
_wcsicmp
memcpy
memset
_vsnwprintf
wcsrchr
ntdll
EtwEventUnregister
EvtIntReportEventAndSourceAsync
EtwEventRegister
ShipAssert
RtlNtStatusToDosError
RtlAllocateHeap
RtlFreeHeap
RtlReAllocateHeap
RtlRaiseStatus
EtwEventWrite
EtwEventEnabled
rpcrt4
NdrServerCall2
I_RpcBindingInqLocalClientPID
RpcRevertToSelf
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcImpersonateClient
RpcRevertToSelfEx
I_RpcBindingIsClientLocal
cryptnet
I_CryptNetSetUrlCachePreFetchInfo
I_CryptNetSetUrlCacheFlushInfo
CryptRetrieveObjectByUrlW
crypt32
RegOpenHKCUKeyExU
CryptMemAlloc
CryptStringToBinaryW
CryptDecodeObjectEx
CryptQueryObject
CertEnumCRLsInStore
CertFreeCRLContext
CertCloseStore
I_CryptFindLruEntry
I_CryptGetLruEntryData
I_CryptEnumMatchingLruEntries
CryptMemFree
I_CryptRemoveLruEntry
I_CryptCreateLruEntry
I_CryptInsertLruEntry
I_CryptReleaseLruEntry
I_CryptFreeLruCache
I_CryptCreateLruCache
I_CertSrvProtectFunction
CryptHashCertificate2
CertCreateContext
CertFreeCTLContext
CryptDecodeObject
kernel32
UnhandledExceptionFilter
GetCurrentThreadId
SetUnhandledExceptionFilter
LCMapStringW
GetCurrentProcessId
TerminateProcess
CompareStringW
lstrlenW
WaitForMultipleObjectsEx
ReleaseMutex
GetThreadLocale
RaiseException
GetFullPathNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemWindowsDirectoryW
GetModuleHandleW
FlushFileBuffers
GetVersionExW
DisableThreadLibraryCalls
CloseHandle
GetCurrentThread
SetEvent
LocalAlloc
LocalFree
LocalSize
LocalReAlloc
GetLastError
UnregisterWaitEx
RegisterWaitForSingleObject
CreateEventW
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryW
SetLastError
WideCharToMultiByte
MultiByteToWideChar
GetACP
MoveFileW
DeleteFileW
GetTempFileNameW
LeaveCriticalSection
EnterCriticalSection
GetSystemDirectoryA
GetSystemDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
CreateFileW
SetFileAttributesW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryExW
GetModuleFileNameW
WaitForSingleObject
SetThreadPriority
FormatMessageW
CompareFileTime
GetFileAttributesExW
DeleteFileA
UnmapViewOfFile
InterlockedExchange
CopyFileW
GetFileSize
ExitThread
FreeLibraryAndExitThread
ResumeThread
CreateThread
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
GetWindowsDirectoryW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
Sleep
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
WriteFile
SetEndOfFile
SetFilePointer
OutputDebugStringA
GetDateFormatA
GetTimeFormatA
GetLocalTime
GetModuleHandleExW
InterlockedIncrement
InterlockedDecrement
FindNextChangeNotification
GetSystemTimeAsFileTime
FindCloseChangeNotification
FindFirstChangeNotificationW
WaitForSingleObjectEx
CreateEventA
DuplicateHandle
GetCurrentProcess
OpenProcess
ReadFile
CreateMutexW
MapViewOfFile
CreateFileMappingW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
Exports
Exports
CryptServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ