WinSCard[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WinSCard.dll
Size

131KB
MD5

fb8032dfbe22b7c48ac9a4ec2feae3f1
SHA1

68b6db16c74209ef45532d470d33b46cb35486dc
SHA256

6e32c8bc35efc18f23d00381e5707f48b4c44f879462c42246d7e7f6cae6866a
SHA512

271f58dbfc9b9e6ecdccbc753617d96cf472286b0a1166ee076f23e6e052b2329db9c24c1e58e7f7e1eaf50a9be9c42855ad10a389255851538fe580c98c9745
SSDEEP

1536:ynWF5Jeax23HMluD5hQo6NhSHVjqMX+jsU9ZNqrokKjvTuWBuTa9PlJU1HV3N:uWjeTuudbXi3NLTuWITaJ7g3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinSCard.dll

Files

WinSCard.dll
.dll windows:6 windows x86 arch:x86

c9d7a0d2005b11c675ea66dfac2c77e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WinSCard.pdb

Imports

msvcrt

??3@YAXPAX@Z
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memset
memcpy
_CxxThrowException
_vsnwprintf
??2@YAPAXI@Z
_wcsicmp
_ultow
wcspbrk
_vsnprintf
_wcsnicmp
_XcptFilter
malloc
free
_initterm
_amsg_exit
??1type_info@@UAE@XZ
_except_handler4_common
__CxxFrameHandler3

ntdll

RtlDeleteCriticalSection
EtwTraceMessage
RtlDllShutdownInProgress
RtlInitializeCriticalSection
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
RtlInitUnicodeString
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapCreate
HeapDestroy
HeapAlloc

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExA
FreeLibrary
GetModuleFileNameW
GetProcAddress

api-ms-win-core-localregistry-l1-1-0

RegSetValueExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW

api-ms-win-core-misc-l1-1-0

lstrlenW
lstrcmpW
Sleep

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
OpenThreadToken
SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

ResetEvent
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
OpenEventW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-threadpool-l1-1-0

CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
GetAce
InitializeAcl
AddAce
GetAclInformation
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
RevertToSelf
GetTokenInformation

rpcrt4

NdrClientCall2
RpcBindingCreateW
RpcBindingBind
NdrMesTypeFree2
NdrMesTypeDecode2
NdrMesTypeEncode2
MesEncodeDynBufferHandleCreate
MesDecodeBufferHandleCreate
MesHandleFree
RpcSsDestroyClientContext
RpcBindingFree
UuidCreate
UuidToStringW
RpcStringFreeW

kernel32

HeapReAlloc
WaitForMultipleObjects
DelayLoadFailureHook
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrlenA
lstrcmpiW
GetModuleHandleW
RegEnumKeyExW
ExpandEnvironmentStringsW
RegDeleteKeyExW
SetLastError
InterlockedIncrement
InterlockedDecrement

Exports

Exports

ClassInstall32
SCardAccessNewReaderEvent
SCardAccessStartedEvent
SCardAddReaderToGroupA
SCardAddReaderToGroupW
SCardBeginTransaction
SCardCancel
SCardConnectA
SCardConnectW
SCardControl
SCardDisconnect
SCardEndTransaction
SCardEstablishContext
SCardForgetCardTypeA
SCardForgetCardTypeW
SCardForgetReaderA
SCardForgetReaderGroupA
SCardForgetReaderGroupW
SCardForgetReaderW
SCardFreeMemory
SCardGetAttrib
SCardGetCardTypeProviderNameA
SCardGetCardTypeProviderNameW
SCardGetProviderIdA
SCardGetProviderIdW
SCardGetStatusChangeA
SCardGetStatusChangeW
SCardGetTransmitCount
SCardIntroduceCardTypeA
SCardIntroduceCardTypeW
SCardIntroduceReaderA
SCardIntroduceReaderGroupA
SCardIntroduceReaderGroupW
SCardIntroduceReaderW
SCardIsValidContext
SCardListCardsA
SCardListCardsW
SCardListInterfacesA
SCardListInterfacesW
SCardListReaderGroupsA
SCardListReaderGroupsW
SCardListReadersA
SCardListReadersW
SCardLocateCardsA
SCardLocateCardsByATRA
SCardLocateCardsByATRW
SCardLocateCardsW
SCardReadCacheA
SCardReadCacheW
SCardReconnect
SCardReleaseAllEvents
SCardReleaseContext
SCardReleaseNewReaderEvent
SCardReleaseStartedEvent
SCardRemoveReaderFromGroupA
SCardRemoveReaderFromGroupW
SCardSetAttrib
SCardSetCardTypeProviderNameA
SCardSetCardTypeProviderNameW
SCardState
SCardStatusA
SCardStatusW
SCardTransmit
SCardWriteCacheA
SCardWriteCacheW
g_rgSCardRawPci
g_rgSCardT0Pci
g_rgSCardT1Pci

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9d7a0d2005b11c675ea66dfac2c77e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 120KB - Virtual size: 120KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB