cryptxml[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cryptxml.dll
Size

122KB
MD5

50b9ade67c5b9e0c6f4d989fe5503e94
SHA1

f67bb11cb79b9b5d7ee5c1443dc24517a97f936b
SHA256

e3109bf4be35021375cff3051c5f6b52430503240886aba25ba1bec1b4f836a8
SHA512

41f5f3a3de6b9629f1cfcd26a366a4cb71a1e06351d03ff2150944876650abc7f69b95631b9b9fb2c8bf4f9e57b78aa3d12d75ff69c393e76301158b82dd493a
SSDEEP

3072:YGCn/P9PIf/Ugnno4acH3h/4X1ts+eACocRQ0wM6AhPKIJHj:on/P9PIf/Ugnnd3h87eACoRQ6uP9Nj

Score

1^/10

Malware Config

Signatures

Files

cryptxml.dll
.dll windows:6 windows x64 arch:x64

548cfcbf244f1ce09713e8cca055b7a5

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2015, 17:15

Not After

18/11/2016, 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:91:e4:20:33:aa:43:e3:39:ff:14:6d:c4:ec:9f:7f:09:9f:6e:6e:2e:cb:bd:80:ad:ad:c8:08:a3:7c:72:d5
Signer

Actual PE Digest

6a:91:e4:20:33:aa:43:e3:39:ff:14:6d:c4:ec:9f:7f:09:9f:6e:6e:2e:cb:bd:80:ad:ad:c8:08:a3:7c:72:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

CryptXml.pdb

Imports

ntdll

EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwTraceMessage
_vsnprintf
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlUnhandledExceptionFilter
RtlVirtualUnwind
memcpy
memcmp
__chkstk
__C_specific_handler
RtlLookupFunctionEntry
RtlCaptureContext
NtTerminateProcess
memmove
RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
memset

api-ms-win-core-heap-l1-2-0

HeapCreate
HeapDestroy
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForMultipleObjectsEx
CreateEventW
WaitForSingleObject
ReleaseMutex
CreateMutexW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-1

GetLastError

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-2

CreateThread
SetThreadStackGuarantee
ResumeThread

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualQuery
VirtualProtect

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrlenW

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

webservices

WsCreateXmlBuffer
WsGetErrorProperty
WsSetInput
WsEndReaderCanonicalization
WsSetWriterPosition
WsWriteEndElement
WsGetErrorString
WsRemoveNode
WsFreeReader
WsFreeWriter
WsCreateError
WsSetInputToBuffer
WsCreateWriter
WsStartReaderCanonicalization
WsWriteElement
WsFreeError
WsReadElement
WsGetReaderPosition
WsCreateReader
WsFreeHeap
WsCreateHeap
WsGetReaderNode
WsSetOutput
WsResetHeap
WsSetReaderPosition
WsFlushWriter
WsAlloc
WsFillReader
WsReadToStartElement
WsReadStartElement
WsMoveWriter
WsSetOutputToBuffer
WsReadNode
WsCopyNode
WsWriteBytes
WsGetWriterPosition
WsGetWriterProperty
WsSkipNode
WsGetReaderProperty
WsMoveReader

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CryptXmlAddObject
CryptXmlClose
CryptXmlCreateReference
CryptXmlDigestReference
CryptXmlEncode
CryptXmlEnumAlgorithmInfo
CryptXmlFindAlgorithmInfo
CryptXmlGetAlgorithmInfo
CryptXmlGetDocContext
CryptXmlGetReference
CryptXmlGetSignature
CryptXmlGetStatus
CryptXmlGetTransforms
CryptXmlImportPublicKey
CryptXmlOpenToDecode
CryptXmlOpenToEncode
CryptXmlSetHMACSecret
CryptXmlSign
CryptXmlVerifySignature

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

548cfcbf244f1ce09713e8cca055b7a5

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

6a:91:e4:20:33:aa:43:e3:39:ff:14:6d:c4:ec:9f:7f:09:9f:6e:6e:2e:cb:bd:80:ad:ad:c8:08:a3:7c:72:d5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-heap-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

webservices

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 99KB - Virtual size: 98KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 208B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1024B

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

6a:91:e4:20:33:aa:43:e3:39:ff:14:6d:c4:ec:9f:7f:09:9f:6e:6e:2e:cb:bd:80:ad:ad:c8:08:a3:7c:72:d5
Signer

.text
Size: 99KB - Virtual size: 98KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 208B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1024B