drtprov.pdb
Static task
static1
Behavioral task
behavioral1
Sample
drtprov.dll
Resource
win10v2004-20240508-en
General
-
Target
drtprov.dll
-
Size
56KB
-
MD5
402ef9ed3714b89a1e555bf38b265717
-
SHA1
efd796c7640db64052d60c8e577199bee680783b
-
SHA256
6139b0ed3d78186c89249bc331d2e4f3d67cacbb42c515a458bcd8b502dfe6c1
-
SHA512
ecd32c1cc50ec511dda4feb29b7d6a1d972da3d9d6327cbb76875479e54b58341567e4a8376b0816ab57e90a763ad2a9eaf16f672756e2d8336957d2a2923c71
-
SSDEEP
768:dY7JqI94PGs+MXURX7UrYU32OiYX93k9iL0iX9Tp51KDqCnsVcbbt2/CMb8:dcOPGs+M07UEG2nRAL0kFWqyKEJ27
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource drtprov.dll
Files
-
drtprov.dll.dll windows:10 windows x86 arch:x86
acf60ea72cecf7d71e3d10bc4e13cd86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memcmp
_vsnwprintf
wcschr
iswdigit
_i64tow_s
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
memset
ntdll
EtwTraceMessage
RtlInitUnicodeString
RtlHashUnicodeString
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventActivityIdControl
crypt32
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CertFreeCertificateContext
CertVerifyTimeValidity
CertAddCertificateContextToStore
CertSaveStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
CertFindCertificateInStore
CertOpenStore
CryptImportPublicKeyInfoEx2
bcrypt
BCryptDestroyHash
BCryptFinishHash
BCryptExportKey
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptDecrypt
BCryptVerifySignature
BCryptGetProperty
BCryptDestroyKey
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptImportKey
BCryptGenerateSymmetricKey
ncrypt
NCryptSignHash
NCryptDecrypt
NCryptFreeObject
kernel32
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
CreateThread
GetLastError
WaitForMultipleObjects
DebugBreak
CloseHandle
ResolveDelayLoadedAPI
DelayLoadFailureHook
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
SetEvent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
UnhandledExceptionFilter
Exports
Exports
DrtCreateDerivedKey
DrtCreateDerivedKeySecurityProvider
DrtCreateDnsBootstrapResolver
DrtCreateNullSecurityProvider
DrtCreatePnrpBootstrapResolver
DrtDeleteDerivedKeySecurityProvider
DrtDeleteDnsBootstrapResolver
DrtDeleteNullSecurityProvider
DrtDeletePnrpBootstrapResolver
Sections
.text Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ