CertEnroll[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CertEnroll.dll
Size

2.5MB
MD5

566152da6d358c76f6bd917597974b05
SHA1

a99963deb08c2ca53ed4ada5e43e735716bcbc65
SHA256

98fef284a7594a359f760f565609c2f22cac16766085d1002b4782d5c733ceb5
SHA512

29ba2069617b4bc75871df1e123e6df58d3d174eb2674dc7569bad083897e1180bf8e005e73b313c7517a526f870aacbe76a55e6e32531e3e14439990991aabb
SSDEEP

49152:xiOHmGQ+muzwj70dY2As5eqKh9mLJihJsRT07tUuqV7:xw7iAs5QrmLwhJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CertEnroll.dll

Files

CertEnroll.dll
.dll regsvr32 windows:10 windows x86 arch:x86

33ef89817c64ce98666d270dbfc464db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CertEnroll.pdb

Imports

msvcrt

_XcptFilter
_initterm
?terminate@@YAXXZ
__CxxFrameHandler3
??1type_info@@UAE@XZ
_lock
_unlock
__dllonexit
_onexit
_errno
_CxxThrowException
realloc
_callnewh
_except_handler4_common
memcmp
_ftol2_sse
_CIpow
__iob_func
memset
calloc
wcsrchr
qsort
wcsstr
srand
wcschr
_stricmp
rand
_wcsnicmp
_itow
_wtoi
iswdigit
?what@exception@@UBEPBDXZ
_wcsicmp
_purecall
wcscat_s
wcscpy_s
malloc
wcsncpy_s
??0exception@@QAE@ABQBD@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strcspn
fprintf
wcscspn
fflush
fclose
fopen
_wgetenv
fseek
ftell
fwrite
iswalpha
strchr
getenv
_vsnprintf
iswxdigit
iswspace
wcsncmp
isdigit
atoi
strncmp
fputws
ferror
_wfopen_s
fwprintf
memmove
vfwprintf
towlower
iswupper
iswlower
towupper
_strnicmp
bsearch
_vsnwprintf
free
memcpy_s
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
memmove_s
_amsg_exit
memcpy

certca

ord869
ord412
ord485
ord487
ord843
ord404
ord416
ord844
ord430
ord703
ord405
ord442
ord434
ord444
ord450
ord486
ord845
ord453
ord819
ord479
ord452
ord846
ord455
ord457
ord460
ord420
ord435
ord413
ord446
ord842
ord436
ord705
ord704
ord841
ord840
ord839
ord449
ord462
ord458
ord456
ord468
ord438
ord454
ord847
ord838
ord601
ord809
ord824
ord602
ord823
ord820
ord445
ord801
ord813
ord808
ord467
ord414
ord440
ord707
ord802

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
InitializeSRWLock
CreateEventExW
LeaveCriticalSection
CreateEventW
AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockShared
InitializeCriticalSection
ReleaseSRWLockExclusive
InitOnceExecuteOnce
AcquireSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExW
SizeofResource
LoadResource
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FindResourceExW
DisableThreadLibraryCalls
LockResource

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumKeyExW
RegOpenCurrentUser
RegGetValueW
RegSetValueExW
RegDeleteKeyExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-string-l2-1-0

CharLowerW
CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
FoldStringW
MultiByteToWideChar
CompareStringW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-sysinfo-l1-2-1

GetSystemDirectoryW
GetSystemTime
GetVersionExW
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-handle-l1-1-0

CloseHandle

crypt32

CryptDecodeObjectEx
CryptMsgUpdate
CryptMsgGetParam
CryptMsgControl
CryptSignCertificate
CertGetEnhancedKeyUsage
CertNameToStrW
CryptBinaryToStringW
CertGetSubjectCertificateFromStore
PFXImportCertStore
CertSerializeCertificateStoreElement
CryptHashPublicKeyInfo
CertCreateCRLContext
CryptExportPublicKeyInfoEx
CryptMsgOpenToDecode
CertVerifySubjectCertificateContext
CertControlStore
CertCreateCertificateContext
CryptVerifyCertificateSignature
CertSaveStore
CertDeleteCertificateFromStore
CryptHashCertificate
CertDuplicateCertificateContext
CryptEncodeObjectEx
CertFindCTLInStore
CertGetCRLContextProperty
CertRegisterPhysicalStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertFreeCRLContext
CryptEncryptMessage
CertEnumCertificateContextProperties
CryptSignMessage
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptDecryptMessage
CertGetCertificateChain
CryptFormatObject
CertGetNameStringW
CryptProtectData
PFXIsPFXBlob
CertStrToNameW
CertSetCertificateContextProperty
CryptMsgClose
CertGetIntendedKeyUsage
CryptDecodeObject
CertOpenStore
CertFindCertificateInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CryptFindOIDInfo
CertGetIssuerCertificateFromStore
CryptQueryObject
CryptImportPublicKeyInfo
CertFindExtension
CertFindAttribute
CryptMsgGetAndVerifySigner
CertComparePublicKeyInfo
CertAddCertificateLinkToStore
CertAddEncodedCertificateToStore
PFXExportCertStoreEx
CryptAcquireCertificatePrivateKey
CertDuplicateStore
CryptStringToBinaryW
CryptEnumOIDInfo
CryptVerifyMessageSignature
CryptMsgCalculateEncodedLength
CryptMsgDuplicate
CryptRegisterOIDInfo
CryptMemFree
CryptVerifyTimeStampSignature
CryptUnprotectMemory
CryptProtectMemory
CryptVerifyCertificateSignatureEx
CertAddSerializedElementToStore
CertFreeCertificateChainList
CertSelectCertificateChains
CryptImportPublicKeyInfoEx2
CertFreeCertificateChainEngine
CertGetPublicKeyLength
CryptHashCertificate2
CryptMsgOpenToEncode

api-ms-win-core-file-l1-2-1

FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFilePointer
SetEndOfFile
CreateDirectoryW
CompareFileTime
GetTempFileNameW
GetFullPathNameW
GetTempPathW
GetFileTime
WriteFile
GetFileType
CreateFileW
GetFileSize
FindClose
FindFirstFileW
DeleteFileW
FindNextFileW

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetACP
IdnToUnicode
IdnToAscii
GetLocaleInfoW

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetCommandLineW
GetStdHandle
SearchPathW

api-ms-win-security-base-l1-2-0

RevertToSelf
IsValidSecurityDescriptor
GetSecurityDescriptorLength
CopySid
ImpersonateLoggedOnUser
FreeSid
GetLengthSid
SetSecurityDescriptorControl
AllocateAndInitializeSid
DuplicateTokenEx
GetTokenInformation
EqualSid
CreateWellKnownSid

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
GetProcessId
OpenProcess

dsparse

DsGetRdnW

rpcrt4

NdrStubCall2
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
UuidCreate
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllCanUnloadNow
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
NdrClientCall4
CStdStubBuffer_QueryInterface
RpcBindingFree
RpcEpResolveBinding
RpcExceptionFilter
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
CStdStubBuffer2_CountRefs
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient7
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
NdrProxyForwardingFunction3
ObjectStublessClient9
ObjectStublessClient21
ObjectStublessClient16
CStdStubBuffer2_Connect
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient14

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-datetime-l1-1-1

GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-memory-l1-1-2

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-2

FindResourceW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
CallbackMayRunLong
TrySubmitThreadpoolCallback

api-ms-win-core-url-l1-1-0

UrlGetPartW

api-ms-win-security-activedirectoryclient-l1-1-0

DsUnBindW

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW
lstrcmpiW

api-ms-win-core-localization-obsolete-l1-3-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

ntdll

RtlCheckTokenCapability
RtlCapabilityCheck
RtlCheckTokenMembershipEx
RtlCheckTokenMembership
RtlSubAuthoritySid
RtlInitializeSid
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlEqualSid
NtQueryInformationToken
WinSqmIncrementDWORD
WinSqmSetString
RtlInitUnicodeString
EtwTraceMessage
EtwEventWriteFull
EtwEventUnregister
EtwEventRegister

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
ImportPFXToProvider
ImportPFXToProviderFreeData
LogCertArchive
LogCertCopy
LogCertDelete
LogCertExpire
LogCertExport
LogCertImport
LogCertInstall
LogCertReplace
UpdateMachinePolicyConfigurationForTemplate

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33ef89817c64ce98666d270dbfc464db

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

certca

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-handle-l1-1-0

crypt32

api-ms-win-core-file-l1-2-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processthreads-l1-1-2

dsparse

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-localization-l1-2-2

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-url-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.data Size: 13KB - Virtual size: 18KB

.idata Size: 14KB - Virtual size: 13KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 214KB - Virtual size: 214KB

.reloc Size: 149KB - Virtual size: 148KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 13KB - Virtual size: 18KB

.idata
Size: 14KB - Virtual size: 13KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 214KB - Virtual size: 214KB

.reloc
Size: 149KB - Virtual size: 148KB