DscCoreConfProv[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DscCoreConfProv.dll
Size

137KB
MD5

b6c40c688112d5446aecf8359dab9fa5
SHA1

03707f2a5c2ab18f62ddae4ceca499dfa6cc58c9
SHA256

11ff9d80bea4d558809da4b541b7853590c5a21bf78209fe4f01f6735a68b8a8
SHA512

9850f6caf41cdea33627f1fec9abf60477ca0a919e7f26293e36dab2e06729a7a4aa49e4692365f2c6f67faa04c3a1848500dc9a86838aae5762a412acbf5525
SSDEEP

3072:zXwKvhsUH0nth4RG/KGHbtDoJRREcfYlYZ577p/2RFGtmjXPd3Zy86HqFDQ1DLaY:F+fdVoJIYL7peHZd3MvLawm2gVvc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DscCoreConfProv.dll

Files

DscCoreConfProv.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a5c7bc525efa125eb97a287779b8b018

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DscCoreConfProv.pdb

Imports

msvcrt

wcscpy_s
_wmakepath_s
wcscat_s
_wcserror_s
swprintf_s
_wsplitpath_s
_wfopen_s
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
fread
feof
_get_errno
fclose
ferror
_wfsopen
wcsncmp
wcspbrk
??0exception@@QAE@ABQBD@Z
_wcsicmp
towlower
_vsnwprintf
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
__CxxFrameHandler3
malloc
free
fputws
memset

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
CreateDirectoryW
DeleteFileW
WriteFile
FindClose
FindFirstFileW
SetFileAttributesW
GetFileSize
CreateFileW
ReadFile
FindNextFileW
FindFirstFileExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

mpr

WNetAddConnection2W
WNetCancelConnection2W

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRootW
PathFindNextComponentW
PathRemoveFileSpecW
PathCanonicalizeW
PathIsUNCServerW
PathRemoveBackslashW
PathStripToRootW
PathCombineW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

cryptsp

CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash

mi

mi_clientFT_V1
MI_Application_InitializeV1

mimofcodec

MI_Application_NewSerializer_Mof
MI_Application_NewDeserializer_Mof

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObject

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-file-l2-1-2

CopyFileW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
NITS_PRESENCE_STUB
NITS_STUB
NativeProviderTraps

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5c7bc525efa125eb97a287779b8b018

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

mpr

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

cryptsp

mi

mimofcodec

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l2-1-2

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 121KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 121KB - Virtual size: 121KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB