cryptui[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

cryptui.dll
Size

230KB
MD5

8b8447c79142804bc8c069c335bfa2c4
SHA1

1a3d5faf0556ddf6146b44983c0c53a8aa6debeb
SHA256

85603f5bb22f985e585c156a582574e41cc1c633931163a33d4f7c48600861b6
SHA512

ef60298677a3d1a606e2521a416ecedd21cc7590fdcb154376f1abc3dd6f601bc4569fcc46c8abb0df5fd912df45c45cba810964164d9a6fb1e0ec540fb4af36
SSDEEP

6144:R1WEysr5HJVUHWjWd04cX4v6EUsziGiEu2cmCtBN:rWEyKEHgWd04cYgsziL5BN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cryptui.dll

Files

cryptui.dll
.dll regsvr32 windows:10 windows x86 arch:x86

0e89168ff6ea8c8725501ce62a420165

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptui.pdb

Imports

msvcrt

_lock
??1type_info@@UAE@XZ
__dllonexit
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_purecall
_onexit
swprintf_s
_wcsdup
_wtoi
iswspace
_stricmp
_wcsicmp
strtok
wcsrchr
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
_itow
iswprint
_vsnprintf
malloc
free
qsort_s
wcschr
_ltow
memcmp
_unlock
??3@YAXPAX@Z
_callnewh
__CxxFrameHandler3
memset

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc
LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-security-base-l1-1-0

GetTokenInformation
IsWellKnownSid
DuplicateToken

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExW
RegCloseKey

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThread
OpenProcessToken
GetCurrentThreadId
OpenThreadToken

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

LoadStringA
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
FreeLibrary
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleA

api-ms-win-core-handle-l1-1-0

CloseHandle

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptCreateHash
BCryptFinishHash

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetSystemTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA
ExpandEnvironmentStringsW

crypt32

CertFindExtension
CertAddSerializedElementToStore
CryptAcquireCertificatePrivateKey
CryptMsgDuplicate
CertFreeCTLContext
CertCreateCertificateChainEngine
CertGetSubjectCertificateFromStore
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CryptFindLocalizedName
CertEnumPhysicalStore
CertEnumSystemStore
CertCompareCertificate
CertCompareCertificateName
CryptFreeOIDFunctionAddress
CertSetEnhancedKeyUsage
CryptEncodeObjectEx
CryptEncodeObject
CertDuplicateStore
CryptGetDefaultOIDFunctionAddress
CryptInitOIDFunctionSet
CryptGetDefaultOIDDllList
CryptEnumOIDInfo
CertOpenStore
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertSaveStore
CertAddCertificateContextToStore
CryptBinaryToStringA
CertGetValidUsages
CertDeleteCertificateFromStore
CertGetEnhancedKeyUsage
CertSetCertificateContextProperty
CryptDecodeObjectEx
CryptQueryObject
CertGetStoreProperty
CertGetCertificateContextProperty
CertGetPublicKeyLength
CertGetNameStringW
CertFindCertificateInStore
CryptFormatObject
CryptMsgVerifyCountersignatureEncoded
CertGetCTLContextProperty
CryptMsgGetParam
CryptMsgControl
CryptMsgOpenToDecode
CryptFindOIDInfo
CertFindAttribute
CryptMsgUpdate
CryptMsgClose
CertGetCRLContextProperty
CertNameToStrW
CertFreeCertificateContext
CryptDecodeObject

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapDestroy
HeapSize
HeapReAlloc

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

gdi32

GetObjectW
CreateFontIndirectW
SetPixel
SelectObject
CreateCompatibleBitmap
GetTextExtentPoint32W
CreateFontIndirectA
GetBkColor
DeleteObject
GetObjectA

user32

MapWindowPoints
SetClassLongA
LoadIconA
GetSysColorBrush
InvalidateRect
ReleaseDC
SetWindowLongA
GetWindowLongA
SendDlgItemMessageA
SendMessageA
GetWindowLongW
MessageBoxW
SetDlgItemTextW
GetNextDlgTabItem
SendMessageW
ReleaseCapture
EndDialog
UpdateWindow
FillRect
SetWindowTextW
GetClientRect
SetCursor
SetCapture
GetDC
MoveWindow
DrawFocusRect
CreateWindowExW
LoadCursorA
GetFocus
GetWindowRect
LoadIconW
DestroyIcon
GetActiveWindow
ScreenToClient
ShowWindow
SendDlgItemMessageW
PeekMessageA
EndPaint
SetClipboardData
SetFocus
BeginPaint
LoadCursorW
SetWindowLongW
GetDlgItem
EmptyClipboard
GetUpdateRect
GetDoubleClickTime
DialogBoxParamW
EnableWindow
GetWindowTextW
RegisterClipboardFormatA
CloseClipboard
OpenClipboard
CallWindowProcA
LoadBitmapA
GetCursor
CallWindowProcW
GetKeyState
DefWindowProcW
GetWindowTextLengthW
SetDlgItemTextA
DrawIcon
IsWindowEnabled
GetDlgItemTextW
GetDlgItemTextA
GetParent
WinHelpW
MessageBoxExW
LoadImageW
DestroyWindow
MonitorFromWindow
GetMonitorInfoW
GetWindow
CopyRect
GetWindowDC
LoadBitmapW
SetRect
MapDialogRect
PostMessageW
CheckRadioButton
IsDlgButtonChecked
PostMessageA
GetSysColor
GetDialogBaseUnits
IsWindowVisible
GetDesktopWindow
DrawTextW
SetWindowPos

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ACUIProviderInvokeUI
AddChainToStore
CertDllLogMismatchPinRules
CertDllProtectedRootMessageBox
CertSelectionGetSerializedBlob
CommonInit
CompareCertificate
CryptDllProtectPrompt
CryptUIDlgAddPolicyServer
CryptUIDlgAddPolicyServerWithPriority
CryptUIDlgCertMgr
CryptUIDlgFreeCAContext
CryptUIDlgFreePolicyServerContext
CryptUIDlgPropertyPolicy
CryptUIDlgSelectCA
CryptUIDlgSelectCertificateA
CryptUIDlgSelectCertificateFromStore
CryptUIDlgSelectCertificateW
CryptUIDlgSelectPolicyServer
CryptUIDlgSelectStoreA
CryptUIDlgSelectStoreW
CryptUIDlgViewCRLA
CryptUIDlgViewCRLW
CryptUIDlgViewCTLA
CryptUIDlgViewCTLW
CryptUIDlgViewCertificateA
CryptUIDlgViewCertificatePropertiesA
CryptUIDlgViewCertificatePropertiesW
CryptUIDlgViewCertificateW
CryptUIDlgViewContext
CryptUIDlgViewSignerInfoA
CryptUIDlgViewSignerInfoW
CryptUIFreeCertificatePropertiesPagesA
CryptUIFreeCertificatePropertiesPagesW
CryptUIFreeViewSignaturesPagesA
CryptUIFreeViewSignaturesPagesW
CryptUIGetCertificatePropertiesPagesA
CryptUIGetCertificatePropertiesPagesW
CryptUIGetViewSignaturesPagesA
CryptUIGetViewSignaturesPagesW
CryptUIStartCertMgr
CryptUIViewExpiringCerts
CryptUIWizBuildCTL
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIWizFreeDigitalSignContext
CryptUIWizImport
CryptUIWizImportInternal
DisplayHtmlHelp
DllRegisterServer
DllUnregisterServer
FormatDateStringAutoLayout
GetUnknownErrorString
InvokeHelpLink
IsWizardExtensionAvailable
MyFormatEnhancedKeyUsageString

Sections

.text
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mytext
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e89168ff6ea8c8725501ce62a420165

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

bcrypt

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

crypt32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 202KB - Virtual size: 202KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 288B

.mytext Size: 512B - Virtual size: 96B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 202KB - Virtual size: 202KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 288B

.mytext
Size: 512B - Virtual size: 96B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 12KB