BioCredProv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
BioCredProv.dll
Resource
win10v2004-20240426-en
General
-
Target
BioCredProv.dll
-
Size
269KB
-
MD5
423eda2e01cbebfd6c8e8579608415f3
-
SHA1
cdf0764db1286c9b1b884f1f85f779c939dc3e42
-
SHA256
deac22fb4101d4899a0ea86b59e964f898b7421ae1d8235ffff5252fefb59081
-
SHA512
f7a7602461e32f1dc4dcf2348dcd9ca2d447e7353fc0744b49d29d625bbe1f494a7887ecf340d021822900bdfee6c375b30e193297631b64b94298598160e7fa
-
SSDEEP
6144:KXQbJuAhlOxO0n9saurRGElq/Rqk2YMR4SjH3qtt:8SJuAcI+2FR4Ea
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BioCredProv.dll
Files
-
BioCredProv.dll.dll windows:10 windows x86 arch:x86
f1bfba6ec5dd40bc620b53dd1cc2ad9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp_win
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Syserror_map@std@@YAPBDH@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
_Mtx_unlock
_Mtx_lock
_Cnd_unregister_at_thread_exit
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
_Cnd_wait
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Cnd_timedwait
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_current_owns
_Xtime_get_ticks
_Cnd_init_in_situ
_Mtx_init_in_situ
?__ExceptionPtrDestroy@@YAXPAX@Z
_Thrd_id
_Thrd_start
_Mtx_destroy
_Cnd_destroy
_Cnd_do_broadcast_at_thread_exit
?_Xbad_function_call@std@@YAXXZ
_Cnd_signal
_Mtx_init
_Cnd_init
?_Xout_of_range@std@@YAXPBD@Z
_Thrd_join
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_terminate
_o_toupper
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
ngckeyenum
NgcCredProvEnumLogonKeys
NgcCredProvFreeBuffer
api-ms-win-core-libraryloader-l1-2-0
LoadResource
FindResourceExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
LockResource
SizeofResource
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
LoadStringW
api-ms-win-core-synch-l1-1-0
CreateEventW
ResetEvent
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
WaitForSingleObject
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseMutex
CreateEventExW
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
ProcessIdToSessionId
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadUILanguage
SetThreadUILanguage
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CLSIDFromString
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventProviderEnabled
EventUnregister
EventActivityIdControl
EventRegister
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
IsValidSid
IsWellKnownSid
GetTokenInformation
CopySid
EqualSid
GetLengthSid
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCloseKey
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-security-credentials-l1-1-0
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
CredFree
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ntdll
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlIsMultiSessionSku
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlGetNtProductType
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ