eapprovp[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

eapprovp.dll
Size

41KB
MD5

94f383675ec3c78f8bd2f246b197bc71
SHA1

2f6d265f41110e96cef83bd5bd0cafaf96f404b1
SHA256

ecef6cd74400b7e8a04c0a11344ca067b361e48e5ff566d8509acec48835ca25
SHA512

911292b7fd1441d033fb66d777e132c2064c1984d0688d8fe925628e8f79b5304877ef3e144f761b86aa542460ebcb7296e45a6075b3006a8624b5cb67bd125d
SSDEEP

768:ZNyQ7+WSwKEI402oNwzb4A8JdTbkRzn9c/7+aKiM:H75sX4xzsAMVbkRzn9c/7JM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eapprovp.dll

Files

eapprovp.dll
.dll windows:10 windows x86 arch:x86

5657ccf8d7fcee478b14c510bdf00fd3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

eapprovp.pdb

Imports

msvcrt

__CxxFrameHandler3
_vsnwprintf
strncat_s
strcpy_s
strcat_s
_except_handler4_common
?terminate@@YAXXZ
_onexit
strnlen
strchr
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
memcpy
memset

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegLoadKeyW
RegUnLoadKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
CreateEventW
CreateMutexW
SetEvent
InitializeCriticalSection
DeleteCriticalSection
ResetEvent

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-security-credentials-l1-1-0

CredUnprotectW
CredFree
CredIsProtectedW
CredWriteA
CredReadW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress

crypt32

CryptUnprotectData
CertFreeCertificateContext
CryptBinaryToStringW
CryptDecodeObjectEx
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindExtension

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

iphlpapi

ConvertInterfaceGuidToLuid
GetIfEntry2

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

wkscli

NetGetJoinInformation

netutils

NetApiBufferFree

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

Exports

Exports

EapProvPlugGetInfo
EapProvPluginDeinitialize
EapProvPluginInitialize
EapProvPluginTestForAuthenticatingWlanInterfaces
EapProvPluginWlanCloseHandle
EapProvPluginWlanOpenHandle
EapProvPluginWlanRegisterNotification

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5657ccf8d7fcee478b14c510bdf00fd3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

crypt32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

iphlpapi

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

wkscli

netutils

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 31KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 31KB - Virtual size: 31KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB