PCPKsp[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PCPKsp.dll
Size

643KB
MD5

3c4d3de94515004208565a77aa865eb7
SHA1

c5c5af8ae22e58d1f628dc6e32c9bde113a72273
SHA256

6ff3ef58a9babb2b789b601c2a9d9ea07dcdf40d1870a2ffe90439631750a514
SHA512

7ccd1a23b54ede33d85bf15cfdb2d331f8967f05cb84f18591d6085fdf8bc999295e981b1cfdfe94777aa2bc0b117be88c47a3e6724b7a2f014efbb4f29a8f32
SSDEEP

12288:YVFqXjkY8HbdyeNO+6FAz7XD0p+00SnsNOE:eFqzA7dySaqz7XYFXnswE

Score

1^/10

Malware Config

Signatures

Files

PCPKsp.dll
.dll windows:10 windows x86 arch:x86

b9ae4b4a4dd90bd7ff79a9d2948f31b5

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:63:a7:d7:44:a4:c7:f7:ef:52:c9:ad:54:74:60:d5:de:90:0f:2b:2e:d9:55:61:ed:5a:96:0d:1b:b3:ec:29
Signer

Actual PE Digest

33:63:a7:d7:44:a4:c7:f7:ef:52:c9:ad:54:74:60:d5:de:90:0f:2b:2e:d9:55:61:ed:5a:96:0d:1b:b3:ec:29

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PCPKsp.pdb

Imports

msvcrt

__dllonexit
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
_unlock
??0exception@@QAE@ABQBD@Z
wcsncmp
_purecall
strncmp
_onexit
?terminate@@YAXXZ
rand
??1type_info@@UAE@XZ
time
srand
_except_handler4_common
memcmp
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
__CxxFrameHandler3
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
_lock
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
LoadStringW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateMutexExW
InitializeCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegGetValueW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumValueW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptHash
BCryptHashData
BCryptEncrypt
BCryptVerifySignature
BCryptCreateHash
BCryptDecrypt
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptKeyDerivation
BCryptGenRandom
BCryptDeriveKey
BCryptDestroySecret
BCryptSecretAgreement
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptFinalizeKeyPair
BCryptExportKey
BCryptUnregisterProvider
BCryptGetProperty
BCryptSetProperty
BCryptRegisterProvider

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

rpcrt4

UuidCreate

api-ms-win-core-file-l1-1-0

CompareFileTime
CreateDirectoryW
WriteFile
FlushFileBuffers
DeleteFileW
CreateFileW
GetFileAttributesExW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetFileTime
GetFileSize
ReadFile

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
GetTokenInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
DuplicateToken
AccessCheck
GetSecurityDescriptorLength
MapGenericMask

crypt32

CertEnumCertificatesInStore
CryptProtectData
CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertCreateCertificateContext
CertOpenStore
CertCreateContext
CryptUnprotectData

ncrypt

NCryptGetProperty
NCryptOpenStorageProvider
NCryptImportKey
NCryptSetProperty
NCryptFinalizeKey
NCryptSignHash
NCryptFreeObject
NCryptDeleteKey
NCryptExportKey

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetNamedSecurityInfoW

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileTransactedW

api-ms-win-core-kernel32-legacy-l1-1-3

DeleteFileTransactedW

api-ms-win-core-registry-l2-1-0

RegOpenKeyW

ntdll

RtlGetPersistedStateLocation
NtCreateTransaction
NtRollbackTransaction
NtCommitTransaction
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllInstall
DllMain
DllUnregisterServer
GetKeyStorageInterface

Sections

.text
Size: 591KB - Virtual size: 590KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9ae4b4a4dd90bd7ff79a9d2948f31b5

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

33:63:a7:d7:44:a4:c7:f7:ef:52:c9:ad:54:74:60:d5:de:90:0f:2b:2e:d9:55:61:ed:5a:96:0d:1b:b3:ec:29Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

bcrypt

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

crypt32

ncrypt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-3

api-ms-win-core-registry-l2-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 591KB - Virtual size: 590KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 52B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 27KB - Virtual size: 26KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

33:63:a7:d7:44:a4:c7:f7:ef:52:c9:ad:54:74:60:d5:de:90:0f:2b:2e:d9:55:61:ed:5a:96:0d:1b:b3:ec:29
Signer

.text
Size: 591KB - Virtual size: 590KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 52B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 27KB - Virtual size: 26KB