cryptui[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cryptui.dll
Size

230KB
MD5

01d46c4f964b87819c0e00d0df5ecf7e
SHA1

ad76fea0775dbcd4aa702bac2040bedd8921606a
SHA256

20d35158fa99ec3f51bfaf9ac1cb73f35ad1120f9f4d659b19f12e3a50aac2ed
SHA512

4eee3132503fe37d90223661fbe5c2b8aece7e45ebb678dff7f8e5bb1a073e536b2d1b6954287df3fdabcde70c3ba0ed74656fd4305a11c199fe990f40c44e65
SSDEEP

6144:80iTtLMSpVcT6jpiEZp87mioF5miEu2S8:TiTtcTEpiEk3oF5F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cryptui.dll

Files

cryptui.dll
.dll regsvr32 windows:10 windows x86 arch:x86

0e89168ff6ea8c8725501ce62a420165

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptui.pdb

Imports

msvcrt

_lock
??1type_info@@UAE@XZ
__dllonexit
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_purecall
_onexit
swprintf_s
_wcsdup
_wtoi
iswspace
_stricmp
_wcsicmp
strtok
wcsrchr
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
_itow
iswprint
_vsnprintf
malloc
free
qsort_s
wcschr
_ltow
memcmp
_unlock
??3@YAXPAX@Z
_callnewh
__CxxFrameHandler3
memset

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc
LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-security-base-l1-1-0

GetTokenInformation
IsWellKnownSid
DuplicateToken

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExW
RegCloseKey

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThread
OpenProcessToken
GetCurrentThreadId
OpenThreadToken

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

LoadStringA
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
FreeLibrary
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleA

api-ms-win-core-handle-l1-1-0

CloseHandle

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptCreateHash
BCryptFinishHash

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetSystemTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA
ExpandEnvironmentStringsW

crypt32

CertFindExtension
CertAddSerializedElementToStore
CryptAcquireCertificatePrivateKey
CryptMsgDuplicate
CertFreeCTLContext
CertCreateCertificateChainEngine
CertGetSubjectCertificateFromStore
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CryptFindLocalizedName
CertEnumPhysicalStore
CertEnumSystemStore
CertCompareCertificate
CertCompareCertificateName
CryptFreeOIDFunctionAddress
CertSetEnhancedKeyUsage
CryptEncodeObjectEx
CryptEncodeObject
CertDuplicateStore
CryptGetDefaultOIDFunctionAddress
CryptInitOIDFunctionSet
CryptGetDefaultOIDDllList
CryptEnumOIDInfo
CertOpenStore
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertSaveStore
CertAddCertificateContextToStore
CryptBinaryToStringA
CertGetValidUsages
CertDeleteCertificateFromStore
CertGetEnhancedKeyUsage
CertSetCertificateContextProperty
CryptDecodeObjectEx
CryptQueryObject
CertGetStoreProperty
CertGetCertificateContextProperty
CertGetPublicKeyLength
CertGetNameStringW
CertFindCertificateInStore
CryptFormatObject
CryptMsgVerifyCountersignatureEncoded
CertGetCTLContextProperty
CryptMsgGetParam
CryptMsgControl
CryptMsgOpenToDecode
CryptFindOIDInfo
CertFindAttribute
CryptMsgUpdate
CryptMsgClose
CertGetCRLContextProperty
CertNameToStrW
CertFreeCertificateContext
CryptDecodeObject

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapDestroy
HeapSize
HeapReAlloc

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

gdi32

GetObjectW
CreateFontIndirectW
SetPixel
SelectObject
CreateCompatibleBitmap
GetTextExtentPoint32W
CreateFontIndirectA
GetBkColor
DeleteObject
GetObjectA

user32

MapWindowPoints
SetClassLongA
LoadIconA
GetSysColorBrush
InvalidateRect
ReleaseDC
SetWindowLongA
GetWindowLongA
SendDlgItemMessageA
SendMessageA
GetWindowLongW
MessageBoxW
SetDlgItemTextW
GetNextDlgTabItem
SendMessageW
ReleaseCapture
EndDialog
UpdateWindow
FillRect
SetWindowTextW
GetClientRect
SetCursor
SetCapture
GetDC
MoveWindow
DrawFocusRect
CreateWindowExW
LoadCursorA
GetFocus
GetWindowRect
LoadIconW
DestroyIcon
GetActiveWindow
ScreenToClient
ShowWindow
SendDlgItemMessageW
PeekMessageA
EndPaint
SetClipboardData
SetFocus
BeginPaint
LoadCursorW
SetWindowLongW
GetDlgItem
EmptyClipboard
GetUpdateRect
GetDoubleClickTime
DialogBoxParamW
EnableWindow
GetWindowTextW
RegisterClipboardFormatA
CloseClipboard
OpenClipboard
CallWindowProcA
LoadBitmapA
GetCursor
CallWindowProcW
GetKeyState
DefWindowProcW
GetWindowTextLengthW
SetDlgItemTextA
DrawIcon
IsWindowEnabled
GetDlgItemTextW
GetDlgItemTextA
GetParent
WinHelpW
MessageBoxExW
LoadImageW
DestroyWindow
MonitorFromWindow
GetMonitorInfoW
GetWindow
CopyRect
GetWindowDC
LoadBitmapW
SetRect
MapDialogRect
PostMessageW
CheckRadioButton
IsDlgButtonChecked
PostMessageA
GetSysColor
GetDialogBaseUnits
IsWindowVisible
GetDesktopWindow
DrawTextW
SetWindowPos

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ACUIProviderInvokeUI
AddChainToStore
CertDllLogMismatchPinRules
CertDllProtectedRootMessageBox
CertSelectionGetSerializedBlob
CommonInit
CompareCertificate
CryptDllProtectPrompt
CryptUIDlgAddPolicyServer
CryptUIDlgAddPolicyServerWithPriority
CryptUIDlgCertMgr
CryptUIDlgFreeCAContext
CryptUIDlgFreePolicyServerContext
CryptUIDlgPropertyPolicy
CryptUIDlgSelectCA
CryptUIDlgSelectCertificateA
CryptUIDlgSelectCertificateFromStore
CryptUIDlgSelectCertificateW
CryptUIDlgSelectPolicyServer
CryptUIDlgSelectStoreA
CryptUIDlgSelectStoreW
CryptUIDlgViewCRLA
CryptUIDlgViewCRLW
CryptUIDlgViewCTLA
CryptUIDlgViewCTLW
CryptUIDlgViewCertificateA
CryptUIDlgViewCertificatePropertiesA
CryptUIDlgViewCertificatePropertiesW
CryptUIDlgViewCertificateW
CryptUIDlgViewContext
CryptUIDlgViewSignerInfoA
CryptUIDlgViewSignerInfoW
CryptUIFreeCertificatePropertiesPagesA
CryptUIFreeCertificatePropertiesPagesW
CryptUIFreeViewSignaturesPagesA
CryptUIFreeViewSignaturesPagesW
CryptUIGetCertificatePropertiesPagesA
CryptUIGetCertificatePropertiesPagesW
CryptUIGetViewSignaturesPagesA
CryptUIGetViewSignaturesPagesW
CryptUIStartCertMgr
CryptUIViewExpiringCerts
CryptUIWizBuildCTL
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIWizFreeDigitalSignContext
CryptUIWizImport
CryptUIWizImportInternal
DisplayHtmlHelp
DllRegisterServer
DllUnregisterServer
FormatDateStringAutoLayout
GetUnknownErrorString
InvokeHelpLink
IsWizardExtensionAvailable
MyFormatEnhancedKeyUsageString

Sections

.text
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mytext
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e89168ff6ea8c8725501ce62a420165

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

bcrypt

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

crypt32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 202KB - Virtual size: 202KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 288B

.mytext Size: 512B - Virtual size: 96B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 202KB - Virtual size: 202KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 288B

.mytext
Size: 512B - Virtual size: 96B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 12KB