cryptngc[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cryptngc.dll
Size

330KB
MD5

65cc5760095ab5160f6013eb3d3769c9
SHA1

c381de561eb6c2301bdaa77d350ac0e88f97a9ad
SHA256

fc7cedd169f75498612a52a939a96848a0bd675fdcb496ae21915bf55039e816
SHA512

4f170aecff8e05722a78e412bde69be16124fe2b3e214c03eb10915e7ef50849f9d6b2dba201cb8551cf2deb3cb680a3225cfc9333194f3e8d3ebc51fa3d3d0a
SSDEEP

6144:2e7BPQ5vCCNMkFLHXA6uDpZ60jyy6wl5ivTEHSdy9HtFUuFIERgsVlEhAxzjiyzZ:2qBa2kFLHXA6uDpZvjz6wl5ivTEHSdyr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cryptngc.dll

Files

cryptngc.dll
.dll windows:10 windows x86 arch:x86

c7340ba8acd37c8381dab86e486e21e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptngc.pdb

Imports

msvcp_win

?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ
?_Incref@facet@locale@std@@UAEXXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-time-l1-1-0

_time32

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
_o_wcstoull
_except_handler4_common
_CxxThrowException
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__cexit
_o__callnewh
_o__crt_atexit
_o___std_exception_copy
wcsstr
__std_terminate
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
SetEvent
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
CreateEventW
ReleaseMutex
CreateMutexExW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
EnterCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
InitializeSRWLock
OpenEventW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
EventActivityIdControl

ncrypt

NCryptOpenKey
NCryptDecrypt
NCryptExportKey
NCryptCreateClaim
NCryptSignHash
NCryptFreeBuffer
NCryptEnumKeys
NCryptGetProperty
NCryptDeleteKey
NCryptFinalizeKey
NCryptCreatePersistedKey
NCryptSetProperty
NCryptFreeObject
NCryptOpenStorageProvider

rpcrt4

NdrClientCall4
RpcBindingFree
RpcExceptionFilter
RpcBindingCreateW
RpcBindingBind

api-ms-win-core-synch-l1-2-0

Sleep

crypt32

CertVerifySubjectCertificateContext
CryptSignMessage
CertCreateCertificateContext
CertGetCertificateContextProperty
CertGetCertificateChain
CertCreateSelfSignCertificate
CryptEncodeObjectEx
CertStrToNameW
CertEnumCertificatesInStore
CertDeleteCertificateFromStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertOpenStore
CertAddCertificateContextToStore
CertCreateCertificateChainEngine
CertVerifyTimeValidity
CertFreeCertificateChainEngine
CertCloseStore
CertFreeCertificateChain
CertFreeCertificateContext

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

IsValidSid
CopySid
GetLengthSid
GetTokenInformation
IsWellKnownSid

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

bcrypt

BCryptDecrypt
BCryptHash
BCryptImportKeyPair
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptEncrypt
BCryptSetProperty

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoInitializeEx

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable

api-ms-win-core-string-l1-1-0

CompareStringEx

devobj

DevObjOpenDevRegKey
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

ntdll

NtQuerySystemInformation
RtlIsMultiSessionSku
RtlUnhandledExceptionFilter
NtTerminateProcess

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

FidoCreateCredential
FidoGetCredential
FidoSignWithCredential
NgcAddBioProtector
NgcAddCompanionDeviceProtector
NgcAddPrebootProtector
NgcCancelPendingUIRequest
NgcChangePin
NgcChangePinSilent
NgcCreateContainer
NgcCreateContainerSilent
NgcCreateTicketForSmartCardKeyOperation
NgcCreateTicketForSmartCardVpn
NgcCreateUserIdKey
NgcCreateUserIdKeyEx
NgcCreateUserIdKeyHandle
NgcDecryptWithSymmetricPopKey
NgcDecryptWithUserIdKey
NgcDecryptWithUserIdKeySilent
NgcDeleteContainer
NgcDeleteContainerEx
NgcDeleteSymmetricPopKeyTransportKey
NgcDeleteUserIdKey
NgcEncryptWithAsymmetricKey
NgcEncryptWithSymmetricPopKey
NgcEnumContainers
NgcEnumUserIdKeys
NgcFreeEnumState
NgcGetDefaultDecryptionKeyName
NgcGetEventInterface
NgcGetKeyAttestationForContainerService
NgcGetKeyAttestationForUserIdKey
NgcGetKeyAttestationForUserIdKey2
NgcGetKeyImplType
NgcGetLogonDecryptionKeyName
NgcGetLogonDecryptionKeyNameForFirstLogonAfterUpgradeFromThreshold
NgcGetPkcs7ChainBlobFromCertificateBlob
NgcGetPolicy
NgcGetPregenKeyState
NgcGetPregenUserKey
NgcGetSymmetricPopKeyTransportKey
NgcGetSymmetricPopKeyTransportKeyName
NgcGetUserIdKeyCertificate
NgcGetUserIdKeyContainerStatus
NgcGetUserIdKeyName
NgcGetUserIdKeyPublicKey
NgcImportSymmetricPopKey
NgcIsAnyContainerInVsm
NgcIsPinRemovable
NgcNotifyVscProvisioned
NgcOpenUserIdKey
NgcPackAuthBuffer
NgcPackPasswordChangeAuthBuffer
NgcQueryEffectiveCertPolicy
NgcQueryEnabled
NgcQueryHardwarePolicy
NgcRemoveBioProtector
NgcRemoveCompanionDeviceProtector
NgcRemovePrebootProtector
NgcRenewKeyAttestation
NgcSignWithSymmetricPopKey
NgcSignWithUserIdKey
NgcSignWithUserIdKeyAndPadding
NgcSignWithUserIdKeyEx
NgcSignWithUserIdKeySilent
NgcUnpackAuthBuffer
NgcUnpackCredData
NgcUnpackPasswordChangeAuthBuffer
NgcVerifyWithSymmetricPopKey

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7340ba8acd37c8381dab86e486e21e0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

ncrypt

rpcrt4

api-ms-win-core-synch-l1-2-0

crypt32

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

bcrypt

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-string-l1-1-0

devobj

api-ms-win-core-heap-obsolete-l1-1-0

ntdll

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 283KB - Virtual size: 282KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 96B

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 283KB - Virtual size: 282KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 96B

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 14KB - Virtual size: 14KB