drprov[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

drprov.dll
Size

18KB
MD5

d6692338b985d4a0ca52b828314d897d
SHA1

b7399d6eef52effb20b883f9ff9060e110a5edc3
SHA256

cb0b7c84c1e2782a95489e2f4d2af4cfdac02676b76f49ff7d6a7091739ea25d
SHA512

a7b895d432b9ddabee58e4d41d0dd22278a3b057d032ea0d26ea1aee37b679f2df21d420f171e6f05f83d900df741f440ef1c86da7e5afa96d163207ff7b09cf
SSDEEP

384:9DV0VyRMEUbXtO3uxbWAW1+fmhQOAiW7EEpjW+6sUWee:VV0Vy0TMEJW1+fma3igZY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
drprov.dll

Files

drprov.dll
.dll windows:6 windows x86 arch:x86

5972f53b6b7372d14b4e50f2f41ac368

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

drprov.pdb

Imports

msvcrt

_wcsnicmp
wcsstr
memcpy
wcsrchr
wcschr
_XcptFilter
malloc
_except_handler4_common
_vsnwprintf
_amsg_exit
_initterm
free

ntdll

NtCreateFile
NtClose
RtlAppendUnicodeToString
NtFsControlFile
NtOpenFile
RtlInitUnicodeString
NtQueryAttributesFile

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-file-l1-1-0

QueryDosDeviceW
DefineDosDeviceW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-misc-l1-1-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

winsta

WinStationIsSessionRemoteable

Exports

Exports

NPAddConnection
NPAddConnection3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPGetCaps
NPGetConnection
NPGetResourceInformation
NPGetResourceParent
NPGetUniversalName
NPOpenEnum

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5972f53b6b7372d14b4e50f2f41ac368

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

winsta

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 492B

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 492B