cryptuiwizard[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cryptuiwizard.dll
Size

102KB
MD5

7e5e6fb1d477aae11e0d3c329877cc38
SHA1

71dd1e3f9dbe7f9ad57deb31099e22d2dc5acd64
SHA256

e7c2bcd13d3ef10f14c75243720abd20fa754201927619aa1ed7a0de38833c35
SHA512

312e28acd851b6a677714fb2158316914fb07f4e03feefd14045ce91a16dac31b893e106d4a0673b2ab040b8fba3b878cd2f9073d6b7aba0ea4b19aeb1ce65b2
SSDEEP

1536:qc3W7xVzjECfUNL0jrBbWtpqmY5dSSNdEYhMGYbY6U4c2gZ1j3F0:xGPjEXubEwmAxhWbYB3V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cryptuiwizard.dll

Files

cryptuiwizard.dll
.dll windows:10 windows x86 arch:x86

61063b358ce9c4eaa17a69e2aa26f0fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptuiwizard.pdb

Imports

msvcrt

_XcptFilter
memcmp
strtoul
_swab
_except_handler4_common
_initterm
malloc
free
_amsg_exit
memcpy
_vsnwprintf
_wcsicmp
iswprint
_ltow
_wtol
_itow
_wcsnicmp
wcschr
memset

cryptui

MyFormatEnhancedKeyUsageString
CryptUIDlgViewCertificateA
CryptUIDlgSelectStoreA
CommonInit
CompareCertificate
FormatDateStringAutoLayout
CryptUIDlgSelectCertificateA
DisplayHtmlHelp
GetUnknownErrorString
AddChainToStore
InvokeHelpLink

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleA
LoadStringW
LoadStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

crypt32

CertGetCRLFromStore
CryptBinaryToStringW
CertSaveStore
CryptBinaryToStringA
PFXImportCertStore
CertEnumCertificateContextProperties
CryptDecodeObject
CryptAcquireCertificatePrivateKey
CertGetEnhancedKeyUsage
CertFreeCRLContext
CertFindExtension
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertVerifyTimeValidity
CryptSIPRetrieveSubjectGuid
CryptDecodeObjectEx
CertGetStoreProperty
CryptEnumOIDInfo
CertGetCertificateContextProperty
CryptStringToBinaryA
CertAddCRLContextToStore
CertOpenStore
CertGetCTLContextProperty
CryptMsgEncodeAndSignCTL
CertGetNameStringW
CertFindCertificateInStore
CertCreateCTLContext
CryptEncodeObject
CertCloseStore
CertDuplicateCertificateContext
CertFindCRLInStore
CryptQueryObject
CertAddCTLContextToStore
PFXVerifyPassword
CertSetCTLContextProperty
CertFreeCTLContext
CertEnumCTLsInStore
CryptFindCertificateKeyProvInfo
CertFindCTLInStore
CertEnumCertificatesInStore
CertGetValidUsages
CertFreeCertificateContext
CryptFormatObject
CertEnumSystemStore
CryptFindOIDInfo
PFXExportCertStoreEx

api-ms-win-core-file-l1-1-0

WriteFile
DeleteFileW
GetFileSize
ReadFile
CreateFileW
GetFileType

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetACP

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstance

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

sspicli

GetUserNameExW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

certenroll

ord42
ord41

ntdll

NtQuerySystemInformationEx
WinSqmIncrementDWORD

gdi32

GetDeviceCaps
DeleteObject
CreateFontIndirectW

user32

PostMessageA
SetWindowTextW
EnableWindow
SendMessageA
DialogBoxParamW
GetDlgItemTextA
GetParent
SetWindowLongA
EndDialog
GetWindowLongA
GetDlgItemTextW
SetFocus
GetDlgItem
SendDlgItemMessageW
RegisterClipboardFormatA
LoadImageW
DestroyIcon
SendMessageW
InvalidateRect
ShowWindow
MessageBoxExW
ReleaseDC
SetDlgItemTextW
SystemParametersInfoW
GetDC
SendDlgItemMessageA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CryptUIWizBuildCTL
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIWizFreeDigitalSignContext
CryptUIWizImport
CryptUIWizImportInternal
DllMain
GetFunctionTable

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61063b358ce9c4eaa17a69e2aa26f0fd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

cryptui

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

crypt32

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-sddl-l1-1-0

sspicli

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

certenroll

ntdll

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 86KB - Virtual size: 85KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 164B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 86KB - Virtual size: 85KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 164B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB