PCPTpm12[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PCPTpm12.dll
Size

526KB
MD5

f4995d00c39044dc42fd8eec0de92143
SHA1

2f2aad8f92eb51d965b78529777495f7db0f7023
SHA256

86903d56fba2a842ae908d5df513c9fc39089c41aa0403e1e7d94e5c0b7a9bd3
SHA512

44a0c93f281e9f222cf6529850f719488be22e9ba19ab377829949ed11daa05aba9a108391c2790e895169e6c36597a44af5b7639a4e9d459710d918b0919822
SSDEEP

6144:Ld4u8icYYez+ss7gNGQtlD+wQSViRg7oVqA22quAsCH8MWI434RVrlRP/uIpLUrB:54J6Yezi7+NSlLgo22wFcMwAV5R31G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PCPTpm12.dll

Files

PCPTpm12.dll
.dll windows:10 windows x86 arch:x86

b46bdd6fb3ad7ad8af9d84774343141f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PCPTpm12.pdb

Imports

msvcrt

_onexit
__dllonexit
_vsnwprintf
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
strncmp
memcpy_s
wcsncmp
_except_handler4_common
memcpy
memcmp
memset

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
InitOnceExecuteOnce
DeleteCriticalSection
Sleep
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegDeleteValueW
RegGetValueW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-file-l1-2-1

CompareFileTime
CreateDirectoryW
SetFilePointer
CreateFileW
WriteFile

crypt32

CertCreateContext
CertOpenStore
CertAddCertificateContextToStore
CertFreeCertificateContext

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

bcrypt

BCryptVerifySignature
BCryptExportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptSecretAgreement
BCryptGenRandom
BCryptDestroySecret
BCryptDecrypt
BCryptDeriveKey
BCryptSetProperty
BCryptKeyDerivation
BCryptGenerateSymmetricKey
BCryptUnregisterProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptHash
BCryptRegisterProvider
BCryptDestroyHash

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l2-2-0

RegOpenKeyW

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

ntdll

RtlNtStatusToDosError
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
NtClose

Exports

Exports

DllInstall
DllUnregisterServer
GetAsymmetricEncryptionInterface
GetRngInterface
GetSealInterface
GetSecretAgreementInterface
GetSignatureInterface
PcpGenerateAikStatement
PcpGenerateAttestationChallenge
PcpGenerateKeyAttestation
PcpGenerateKeyAttestationStatement
PcpGetKeyAlgorithm
PcpIsKeyAlgorithmSupported
PcpVerifyAikStatement
PcpVerifyKeyAttestation
PcpVerifyKeyAttestationStatement

Sections

.text
Size: 498KB - Virtual size: 498KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b46bdd6fb3ad7ad8af9d84774343141f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

crypt32

api-ms-win-core-errorhandling-l1-1-1

bcrypt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-registry-l2-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-delayload-l1-1-1

ntdll

Exports

Exports

Sections

.text Size: 498KB - Virtual size: 498KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 36B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 498KB - Virtual size: 498KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 36B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB