WinSCard[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WinSCard.dll
Size

166KB
MD5

2d261962cd1bd8096c578a8f71c12576
SHA1

2715c3547c3373b68731fead24c3348800d96b32
SHA256

3b5cbf5a7078ded0faa19bc08c9048f8c9f15be69520e2a7fe243c5e8489158c
SHA512

85df3a13412d2187622238a8a3b203609269113f748af05d1e2206214b419e0dd27aea6a077a6c949360445fa84167f9c6bf967e6f391f71fd27e57aac466cb9
SSDEEP

3072:Ew8xWWKLsAbeLanOOnScnRdw3HWTywN84+UYUODFyv:E7WWKNbeAOOnScRG3lwIPDFy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinSCard.dll

Files

WinSCard.dll
.dll windows:6 windows x86 arch:x86

2ea802a6d2e97af52cf57cf4468d0a41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WinSCard.pdb

Imports

msvcrt

_vsnprintf
wcspbrk
_ultow
??3@YAXPAX@Z
_vsnwprintf
??_V@YAXPAX@Z
??2@YAPAXI@Z
_wcsicmp
_wcsnicmp
_XcptFilter
_amsg_exit
free
malloc
_initterm
??1type_info@@UAE@XZ
_except_handler4_common
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
??_U@YAPAXI@Z
_wtoi
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids

ntdll

NtDeviceIoControlFile
RtlInitializeCriticalSection
RtlDeleteCriticalSection
NtCancelIoFileEx
NtCreateFile
RtlDllShutdownInProgress
RtlInitUnicodeString
EtwTraceMessage

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-1

ReadFile
CreateFileW
GetFileSizeEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
SizeofResource
FreeLibrary
LoadResource
LockResource

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
GetCurrentProcess
GetCurrentThread
GetProcessId
GetCurrentThreadId
SetThreadToken
OpenProcessToken
TerminateProcess
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

CreateEventW
OpenEventW
DeleteCriticalSection
ResetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeConditionVariable
InitializeCriticalSection
SetEvent
WaitForSingleObject
SleepConditionVariableCS
InitializeCriticalSectionAndSpinCount
Sleep

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWait
CloseThreadpoolCleanupGroup
CreateThreadpoolWait
CreateThreadpoolCleanupGroup

api-ms-win-security-base-l1-2-0

GetSidLengthRequired
InitializeSid
AddAce
GetTokenInformation
DuplicateTokenEx
RevertToSelf
IsValidSid
AddAccessAllowedAce
InitializeAcl
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAclInformation
GetSidSubAuthority
GetLengthSid

rpcrt4

RpcSsDestroyClientContext
NdrClientCall2
RpcBindingBind
RpcBindingCreateW
NdrMesTypeEncode2
NdrMesTypeFree2
NdrMesTypeDecode2
MesHandleFree
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
UuidCreate
RpcStringFreeW
UuidToStringW
RpcBindingFree

devobj

DevObjOpenDeviceInfo
DevObjGetDeviceProperty
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList

kernel32

HeapReAlloc
WaitForMultipleObjects
WakeAllConditionVariable
SetLastError
lstrcmpiW
RegEnumKeyExW
RegDeleteKeyExW
lstrlenW
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrlenA
FindResourceW
lstrcmpW
QueryFullProcessImageNameW
DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

ClassInstall32
SCardAccessNewReaderEvent
SCardAccessStartedEvent
SCardAddReaderToGroupA
SCardAddReaderToGroupW
SCardAudit
SCardBeginTransaction
SCardCancel
SCardConnectA
SCardConnectW
SCardControl
SCardDisconnect
SCardEndTransaction
SCardEstablishContext
SCardForgetCardTypeA
SCardForgetCardTypeW
SCardForgetReaderA
SCardForgetReaderGroupA
SCardForgetReaderGroupW
SCardForgetReaderW
SCardFreeMemory
SCardGetAttrib
SCardGetCardTypeProviderNameA
SCardGetCardTypeProviderNameW
SCardGetDeviceTypeIdA
SCardGetDeviceTypeIdW
SCardGetProviderIdA
SCardGetProviderIdW
SCardGetReaderDeviceInstanceIdA
SCardGetReaderDeviceInstanceIdW
SCardGetReaderIconA
SCardGetReaderIconW
SCardGetStatusChangeA
SCardGetStatusChangeW
SCardGetTransmitCount
SCardIntroduceCardTypeA
SCardIntroduceCardTypeW
SCardIntroduceReaderA
SCardIntroduceReaderGroupA
SCardIntroduceReaderGroupW
SCardIntroduceReaderW
SCardIsValidContext
SCardListCardsA
SCardListCardsW
SCardListInterfacesA
SCardListInterfacesW
SCardListReaderGroupsA
SCardListReaderGroupsW
SCardListReadersA
SCardListReadersW
SCardListReadersWithDeviceInstanceIdA
SCardListReadersWithDeviceInstanceIdW
SCardLocateCardsA
SCardLocateCardsByATRA
SCardLocateCardsByATRW
SCardLocateCardsW
SCardReadCacheA
SCardReadCacheW
SCardReconnect
SCardReleaseAllEvents
SCardReleaseContext
SCardReleaseNewReaderEvent
SCardReleaseStartedEvent
SCardRemoveReaderFromGroupA
SCardRemoveReaderFromGroupW
SCardSetAttrib
SCardSetCardTypeProviderNameA
SCardSetCardTypeProviderNameW
SCardState
SCardStatusA
SCardStatusW
SCardTransmit
SCardWriteCacheA
SCardWriteCacheW
g_rgSCardRawPci
g_rgSCardT0Pci
g_rgSCardT1Pci

Sections

.text
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ea802a6d2e97af52cf57cf4468d0a41

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

rpcrt4

devobj

kernel32

Exports

Exports

Sections

.text Size: 145KB - Virtual size: 144KB

.data Size: 2KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 76B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 145KB - Virtual size: 144KB

.data
Size: 2KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 76B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB