SmartcardCredentialProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SmartcardCredentialProvider.dll
Size

623KB
MD5

1ccffe2ce356b6c7efae6e0fc732a8ca
SHA1

db4c88d0a7dc3506347703aee87b4d16293c1e86
SHA256

0df4147013934a8ba89cb9bbe0ecc8658c55d79423028595029fc597408bb88b
SHA512

c7a481d1df90bc987046d5e1facfe4ff280460fd5aba95e4f861ee508cf91d48ea522c5a504c41d5fcbb63e4c2a41d6e1963f3b32a032fbe8e45c63e126c82fc
SSDEEP

12288:obxvAqdLFDaFeH5cSGqW6+hLKTXNY7aQ4B:obx1LFDaFeH5czqW6+ca7aQ4B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SmartcardCredentialProvider.dll

Files

SmartcardCredentialProvider.dll
.dll windows:10 windows x86 arch:x86

70c0cb23cbd2b575948f13ad1b55237e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SmartcardCredentialProvider.pdb

Imports

msvcp_win

??Bid@locale@std@@QAEIXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-string-l1-1-0

wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memcpy
_o__wcsicmp
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_malloc
_o_memset
_o_towupper
_o_wcscpy_s
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
wcsrchr
wcschr
__std_terminate
memmove
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LockResource
LoadResource
FindResourceExW
LoadLibraryExW
LoadStringW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

CreateWaitableTimerExW
SetEvent
CancelWaitableTimer
Sleep
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
ResetEvent
CreateEventW
CreateSemaphoreExW
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
ReleaseMutex
WaitForMultipleObjectsEx
WaitForSingleObject
ReleaseSemaphore
SetWaitableTimer

api-ms-win-core-heap-l1-2-0

HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-2

IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThread
ResumeThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId
SetThreadToken

api-ms-win-core-localization-l1-2-1

LocaleNameToLCID
GetUserDefaultLCID
GetThreadLocale
FormatMessageW
GetSystemDefaultLCID

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-registry-l1-1-0

RegSetValueExA
RegDeleteKeyExW
RegOpenKeyExW
RegGetValueW
RegOpenKeyExA
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExA

api-ms-win-security-credentials-l1-1-0

CredMarshalCredentialW
CredFree
CredIsProtectedW
CredProtectW
CredWriteW
CredReadDomainCredentialsW

api-ms-win-security-base-l1-2-0

RevertToSelf
EqualSid
GetLengthSid
CopySid
ImpersonateLoggedOnUser
IsValidSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

rpcrt4

UuidToStringW
RpcStringFreeW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
CallbackMayRunLong
SetEventWhenCallbackReturns
CreateThreadpool
TrySubmitThreadpoolCallback
CloseThreadpoolWait
CloseThreadpool
CreateThreadpoolWork
SetThreadpoolWait

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-file-l1-2-1

CompareFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-downlevel-shlwapi-l1-1-1

QISearch

ntdll

RtlFreeHeap
RtlImageNtHeader
RtlAllocateHeap
RtlInitializeCriticalSection
RtlInitAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlGetActiveConsoleId
RtlInitString
RtlNtStatusToDosError

kernel32

GlobalUnlock
lstrlenW
VirtualProtect
UnregisterWaitEx
RegisterWaitForSingleObject
VirtualAlloc
VirtualQuery
SetThreadStackGuarantee
GetSystemInfo
GlobalLock

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 529KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70c0cb23cbd2b575948f13ad1b55237e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-security-sddl-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-1

ntdll

kernel32

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 529KB - Virtual size: 529KB

.data Size: 3KB - Virtual size: 5KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 464B

.rsrc Size: 43KB - Virtual size: 42KB

.reloc Size: 36KB - Virtual size: 36KB

.text
Size: 529KB - Virtual size: 529KB

.data
Size: 3KB - Virtual size: 5KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 464B

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 36KB - Virtual size: 36KB