bcryptprimitives[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

bcryptprimitives.dll
Size

243KB
MD5

6b98026761228f913e9fa3f974920a20
SHA1

89a1464406ae48b1ba78f1630b913b75b46ff0f2
SHA256

d80dcec4b5554e84491b06c624098123033b840f88157ef402edad2163b0a734
SHA512

758fb200187acd7628ba438477edd810c60eef1024b99316ebf9a2f0b3e6c1c5377e25d3cecd70d7f9befae8f5aa544d060133868f65772a9fc9ddae9831ffbb
SSDEEP

6144:1fb/qqDATG+sC90/OVHR/kFjUE60LCD4EDMK57Y/:1TiqUTG+sC0/OP/kFjU4Cx4N

Score

1^/10

Malware Config

Signatures

Files

bcryptprimitives.dll
.dll windows:6 windows x86 arch:x86

5e7f9777b4ce3e8c2d00e88603a230e9

Code Sign

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:38:ca:5a:c0:59:e4:1f:bc:39:00:01:00:00:00:38
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/02/2016, 17:53

Not After

19/08/2016, 17:53

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0a:59:2b:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

11/02/2016, 23:24

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:82:5d:25:de:aa:6c:01:45:ec:fa:d4:ac:90:da:fc:2c:95:fe:67:3d:4c:fc:6c:66:1a:0b:19:db:59:35:cb
Signer

Actual PE Digest

5b:82:5d:25:de:aa:6c:01:45:ec:fa:d4:ac:90:da:fc:2c:95:fe:67:3d:4c:fc:6c:66:1a:0b:19:db:59:35:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

bcryptprimitives.pdb

Imports

ntdll

NtQueryValueKey
NtClose
RtlInitUnicodeString
RtlAllocateHeap
RtlFreeHeap
_alloca_probe
_vsnwprintf
memmove
NtOpenFile
RtlInitializeCriticalSection
RtlImageNtHeader
RtlUnwind
wcscpy_s
memset
memcpy
RtlUnhandledExceptionFilter
NtTerminateProcess
NtOpenKey
_chkstk

kernel32

SetLastError
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
RtlMoveMemory
CloseHandle
DeviceIoControl
HeapAlloc
InterlockedIncrement
DeleteCriticalSection
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
InterlockedCompareExchange
GetVersion
VirtualQuery
GetSystemInfo
GetModuleHandleW
GetProcAddress
VirtualAlloc
VirtualProtect
IsProcessorFeaturePresent

advapi32

SystemFunction040
SystemFunction041

bcrypt

BCryptGetProperty
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetFipsAlgorithmMode
BCryptDecrypt

Exports

Exports

GetAsymmetricEncryptionInterface
GetCipherInterface
GetHashInterface
GetRngInterface
GetSecretAgreementInterface
GetSignatureInterface

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e7f9777b4ce3e8c2d00e88603a230e9

Code Sign

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9aCertificate

Extended Key Usages

33:00:00:00:38:ca:5a:c0:59:e4:1f:bc:39:00:01:00:00:00:38Certificate

Extended Key Usages

61:0a:59:2b:00:00:00:00:00:3bCertificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

5b:82:5d:25:de:aa:6c:01:45:ec:fa:d4:ac:90:da:fc:2c:95:fe:67:3d:4c:fc:6c:66:1a:0b:19:db:59:35:cbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

advapi32

bcrypt

Exports

Exports

Sections

.text Size: 211KB - Virtual size: 211KB

.data Size: 16KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a
Certificate

33:00:00:00:38:ca:5a:c0:59:e4:1f:bc:39:00:01:00:00:00:38
Certificate

61:0a:59:2b:00:00:00:00:00:3b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

5b:82:5d:25:de:aa:6c:01:45:ec:fa:d4:ac:90:da:fc:2c:95:fe:67:3d:4c:fc:6c:66:1a:0b:19:db:59:35:cb
Signer

.text
Size: 211KB - Virtual size: 211KB

.data
Size: 16KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB