certca[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

certca.dll
Size

639KB
MD5

b88755d4477797786940aa10b60203da
SHA1

317ef3d59bb6175e1a5ce5de2d52e35e534a2bab
SHA256

815c7d65257a7916d92f8ed8fe4b439223144a6172f5aabe26fd68991ba3a912
SHA512

d12f6c7ce1b75bb261b2da89fb15edf602ca48cc21463e4b51445970e9f87be42a37d3b81135ea07298e3cbc011021eedd41e088eb5e44b8b34ff7c6839138db
SSDEEP

12288:reOQEyRT0eMQNmDWJXb/T1YiLvHrEJul0e5kZ/WTDzjTAQjTDzj6qaI:resyRT2QN6qXbOiLrdkZ/WTDzjTAQjTv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
certca.dll

Files

certca.dll
.dll windows:10 windows x86 arch:x86

6a620f3f99ef0447733fe092fef43780

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

certca.pdb

Imports

msvcrt

??1exception@@UAE@XZ
__iob_func
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
free
_initterm
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
??3@YAXPAX@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strcspn
fprintf
wcscspn
fflush
fclose
fopen
_errno
_wgetenv
fseek
ftell
fwrite
_vsnwprintf
iswalpha
strchr
getenv
_vsnprintf
??_V@YAXPAX@Z
wcschr
_wcsicmp
iswspace
iswxdigit
iswdigit
_wtoi
??0exception@@QAE@ABV0@@Z
__isascii
isxdigit
swscanf
wcsrchr
wcsstr
_wcsnicmp
isdigit
atoi
strncmp
fputws
ferror
_wfopen_s
fwprintf
_swab
vfwprintf
wcstoul
iswupper
towlower
iswlower
towupper
wcsncmp
strrchr
wcstok
_wtol
wcstol
bsearch
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
memcmp
__CxxFrameHandler3
_lock
memset

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadLibraryExW
LoadResource
LoadStringW
GetProcAddress
FindResourceExW
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
InitializeCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

crypt32

CertGetNameStringW
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptEnumOIDInfo
CryptFormatObject
CryptEncodeObject
CertGetCRLContextProperty
CertDeleteCTLFromStore
CertFindCTLInStore
CertAddEncodedCTLToStore
CryptMsgEncodeAndSignCTL
CryptHashPublicKeyInfo
CryptHashCertificate
CryptDecodeObjectEx
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertDuplicateCertificateContext
CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CertGetIntendedKeyUsage
CertFreeCertificateChainEngine
CertCloseStore
CertCreateCertificateChainEngine
CertOpenStore
CertGetEnhancedKeyUsage
CryptEncodeObjectEx
CertNameToStrW
CertEnumCertificatesInStore
CryptFindOIDInfo
CryptInitOIDFunctionSet
CryptGetOIDFunctionAddress
CryptFreeOIDFunctionAddress
CertCreateCertificateContext
CertFindExtension

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThread
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentProcess
CreateThread
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetComputerNameExW
GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

GetFileSize
CreateFileW
GetFullPathNameW
ReadFile
CompareFileTime
FileTimeToLocalFileTime
GetFileAttributesW
LocalFileTimeToFileTime
WriteFile
GetTempFileNameW
GetFileType
DeleteFileW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCloseKey
RegDeleteKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegGetValueW

api-ms-win-security-base-l1-1-0

AddAccessAllowedObjectAce
AddAccessAllowedAce
GetSecurityDescriptorLength
GetSidSubAuthority
GetLengthSid
AdjustTokenPrivileges
InitializeAcl
AccessCheck
GetSidIdentifierAuthority
InitializeSid
GetSidLengthRequired
GetSidSubAuthorityCount
GetSecurityDescriptorControl
GetAclInformation
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAce
GetSecurityDescriptorGroup
AccessCheckByType
GetSecurityDescriptorDacl
AllocateAndInitializeSid
DuplicateToken
CheckTokenMembership
FreeSid
DeleteAce
RevertToSelf
ImpersonateLoggedOnUser
CreateWellKnownSid
EqualSid
GetTokenInformation
MakeAbsoluteSD
GetAce
MakeSelfRelativeSD
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
CopySid
GetSecurityDescriptorOwner
SetSecurityDescriptorGroup

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte
FoldStringW

api-ms-win-core-string-l2-1-0

CharLowerW

rpcrt4

UuidCreate

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
SearchPathW
GetStdHandle
GetEnvironmentVariableW

api-ms-win-core-localization-l1-2-0

IdnToUnicode
GetACP
GetLocaleInfoW
FormatMessageW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

wldap32

ord147
ord167
ord127
ord12
ord65
ord142
ord155
ord79
ord18
ord210
ord145
ord14
ord73
ord113
ord40
ord21
ord194
ord10
ord133
ord27
ord69
ord41
ord140
ord26
ord16
ord36
ord203
ord13
ord224

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-security-logon-l1-1-0

LogonUserExW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

ntdll

RtlFreeUnicodeString
RtlUTF8StringToUnicodeString
RtlInitUTF8String
RtlNtStatusToDosError
RtlValidRelativeSecurityDescriptor
RtlFindMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

Exports

Exports

CAAccessCheck
CAAccessCheckEx
CAAddCACertificateType
CAAddCACertificateTypeEx
CACertTypeAccessCheck
CACertTypeAccessCheckEx
CACertTypeAuthzAccessCheck
CACertTypeGetSecurity
CACertTypeQuery
CACertTypeRegisterQuery
CACertTypeSetSecurity
CACertTypeUnregisterQuery
CACloneCertType
CACloseCA
CACloseCertType
CACountCAs
CACountCertTypes
CACreateAutoEnrollmentObjectEx
CACreateCertType
CACreateLocalAutoEnrollmentObject
CACreateNewCA
CADCSetCertTypePropertyEx
CADeleteCA
CADeleteCAEx
CADeleteCertType
CADeleteCertTypeEx
CADeleteLocalAutoEnrollmentObject
CAEnumCertTypes
CAEnumCertTypesEx
CAEnumCertTypesEx2
CAEnumCertTypesForCA
CAEnumCertTypesForCAEx
CAEnumFirstCA
CAEnumNextCA
CAEnumNextCertType
CAFindByCertType
CAFindByIssuerDN
CAFindByName
CAFindCertTypeByName
CAFindCertTypeByName2
CAFreeCAProperty
CAFreeCertTypeExtensions
CAFreeCertTypeProperty
CAGetCACertificate
CAGetCAExpiration
CAGetCAFlags
CAGetCAProperty
CAGetCASecurity
CAGetCertTypeExpiration
CAGetCertTypeExtensions
CAGetCertTypeExtensionsEx
CAGetCertTypeFlags
CAGetCertTypeFlagsEx
CAGetCertTypeKeySpec
CAGetCertTypeProperty
CAGetCertTypePropertyEx
CAGetDN
CAInstallDefaultCertType
CAInstallDefaultCertTypeEx
CAIsCertTypeCurrent
CAIsCertTypeCurrentEx
CAOIDAdd
CAOIDAddEx
CAOIDCreateNew
CAOIDCreateNewEx
CAOIDDelete
CAOIDDeleteEx
CAOIDFreeLdapURL
CAOIDFreeProperty
CAOIDGetLdapURL
CAOIDGetProperty
CAOIDGetPropertyEx
CAOIDSetProperty
CAOIDSetPropertyEx
CARemoveCACertificateType
CARemoveCACertificateTypeEx
CASetCACertificate
CASetCAExpiration
CASetCAFlags
CASetCAProperty
CASetCASecurity
CASetCertTypeExpiration
CASetCertTypeExtension
CASetCertTypeFlags
CASetCertTypeFlagsEx
CASetCertTypeKeySpec
CASetCertTypeProperty
CASetCertTypePropertyEx
CAUpdateCA
CAUpdateCAEx
CAUpdateCertType
CAUpdateCertTypeEx
CCFindCertificateBuildFilter
CCFindCertificateFreeFilter
CCFindCertificateFromFilter
CCFreeStringArray
CCGetCertNameList

Sections

.text
Size: 587KB - Virtual size: 586KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a620f3f99ef0447733fe092fef43780

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

crypt32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-l2-1-0

rpcrt4

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-datetime-l1-1-0

wldap32

api-ms-win-core-util-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-security-logon-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

Exports

Exports

Sections

.text Size: 587KB - Virtual size: 586KB

.data Size: 9KB - Virtual size: 10KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 236B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 587KB - Virtual size: 586KB

.data
Size: 9KB - Virtual size: 10KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 236B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 30KB