WinSCard[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WinSCard.dll
Size

131KB
MD5

e9224ed7a75dd6186539e5d6735a4528
SHA1

b0d942eed9337fa2f715319b44c3f1f665df2c9f
SHA256

41627d24b0d08099a08759108a86be9a2b5cbd33e6b3570d679aac32bdda115b
SHA512

0255d7e15192ab9825fe257dbf35bb064bc1d64861e00625afb6d2c9f0152971881cc68020b68d95dec7ec9eb1b8e62b9070f7fa623180ef7a8743827fb10651
SSDEEP

1536:mnWF5Jeax23HMluD5hQo6NhSHVjqMX+jsU9ZNqrokKjvTuWBuTexPlJU1HV3N:6WjeTuudbXi3NLTuWITet7g3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinSCard.dll

Files

WinSCard.dll
.dll windows:6 windows x86 arch:x86

c9d7a0d2005b11c675ea66dfac2c77e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WinSCard.pdb

Imports

msvcrt

??3@YAXPAX@Z
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memset
memcpy
_CxxThrowException
_vsnwprintf
??2@YAPAXI@Z
_wcsicmp
_ultow
wcspbrk
_vsnprintf
_wcsnicmp
_XcptFilter
malloc
free
_initterm
_amsg_exit
??1type_info@@UAE@XZ
_except_handler4_common
__CxxFrameHandler3

ntdll

RtlDeleteCriticalSection
EtwTraceMessage
RtlDllShutdownInProgress
RtlInitializeCriticalSection
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
RtlInitUnicodeString
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapCreate
HeapDestroy
HeapAlloc

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExA
FreeLibrary
GetModuleFileNameW
GetProcAddress

api-ms-win-core-localregistry-l1-1-0

RegSetValueExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW

api-ms-win-core-misc-l1-1-0

lstrlenW
lstrcmpW
Sleep

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
OpenThreadToken
SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

ResetEvent
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
OpenEventW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-threadpool-l1-1-0

CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
GetAce
InitializeAcl
AddAce
GetAclInformation
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
RevertToSelf
GetTokenInformation

rpcrt4

NdrClientCall2
RpcBindingCreateW
RpcBindingBind
NdrMesTypeFree2
NdrMesTypeDecode2
NdrMesTypeEncode2
MesEncodeDynBufferHandleCreate
MesDecodeBufferHandleCreate
MesHandleFree
RpcSsDestroyClientContext
RpcBindingFree
UuidCreate
UuidToStringW
RpcStringFreeW

kernel32

HeapReAlloc
WaitForMultipleObjects
DelayLoadFailureHook
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrlenA
lstrcmpiW
GetModuleHandleW
RegEnumKeyExW
ExpandEnvironmentStringsW
RegDeleteKeyExW
SetLastError
InterlockedIncrement
InterlockedDecrement

Exports

Exports

ClassInstall32
SCardAccessNewReaderEvent
SCardAccessStartedEvent
SCardAddReaderToGroupA
SCardAddReaderToGroupW
SCardBeginTransaction
SCardCancel
SCardConnectA
SCardConnectW
SCardControl
SCardDisconnect
SCardEndTransaction
SCardEstablishContext
SCardForgetCardTypeA
SCardForgetCardTypeW
SCardForgetReaderA
SCardForgetReaderGroupA
SCardForgetReaderGroupW
SCardForgetReaderW
SCardFreeMemory
SCardGetAttrib
SCardGetCardTypeProviderNameA
SCardGetCardTypeProviderNameW
SCardGetProviderIdA
SCardGetProviderIdW
SCardGetStatusChangeA
SCardGetStatusChangeW
SCardGetTransmitCount
SCardIntroduceCardTypeA
SCardIntroduceCardTypeW
SCardIntroduceReaderA
SCardIntroduceReaderGroupA
SCardIntroduceReaderGroupW
SCardIntroduceReaderW
SCardIsValidContext
SCardListCardsA
SCardListCardsW
SCardListInterfacesA
SCardListInterfacesW
SCardListReaderGroupsA
SCardListReaderGroupsW
SCardListReadersA
SCardListReadersW
SCardLocateCardsA
SCardLocateCardsByATRA
SCardLocateCardsByATRW
SCardLocateCardsW
SCardReadCacheA
SCardReadCacheW
SCardReconnect
SCardReleaseAllEvents
SCardReleaseContext
SCardReleaseNewReaderEvent
SCardReleaseStartedEvent
SCardRemoveReaderFromGroupA
SCardRemoveReaderFromGroupW
SCardSetAttrib
SCardSetCardTypeProviderNameA
SCardSetCardTypeProviderNameW
SCardState
SCardStatusA
SCardStatusW
SCardTransmit
SCardWriteCacheA
SCardWriteCacheW
g_rgSCardRawPci
g_rgSCardT0Pci
g_rgSCardT1Pci

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9d7a0d2005b11c675ea66dfac2c77e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 120KB - Virtual size: 120KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB