CryptoWinRT[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CryptoWinRT.dll
Size

301KB
MD5

ddfedb5baaf3b40870d67ca44aacbd10
SHA1

6e7a8baa0ba584e955edb063691cf0051f8fa971
SHA256

bb31657c522d8879837165d18ff74bb968243ac12ad6c6ef9db822670c79e2d6
SHA512

c605f16e7d4aaf481cf035ad6d3d4002f68aa32b7be9796e23664ba2b497bd6bcfc0f6c28f8b39e9fdde36566f6c33862a99ec2374c2f8786c67be21fed0e400
SSDEEP

6144:e2ncGKUT37WPBS93P8fs8aiYnTH4oupk10juXVJmYxJZe+MyoNYur:e2ncGKUT3aw93P8k8aiYnTHnupk10ju4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CryptoWinRT.dll

Files

CryptoWinRT.dll
.dll windows:10 windows x86 arch:x86

aa43943ce8e3b03df3ee539ba3e70d79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CryptoWinRT.pdb

Imports

msvcrt

__CxxFrameHandler3
memcpy
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
free
_purecall
realloc
_callnewh
malloc
memcmp
memset

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetModuleHandleExA

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl

rpcrt4

NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
NdrStubCall2
CStdStubBuffer_CountRefs
CStdStubBuffer_Connect
NdrStubForwardingFunction
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
NdrDllCanUnloadNow
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
UuidCreate
NdrCStdStubBuffer2_Release

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsDuplicateString
HSTRING_UserSize
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsCreateStringReference
WindowsIsStringEmpty
HSTRING_UserMarshal
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
HSTRING_UserFree
WindowsCreateString
HSTRING_UserUnmarshal

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient14
ObjectStublessClient11
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
ObjectStublessClient12
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient21
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient16
ObjectStublessClient20
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient24
ObjectStublessClient17
ObjectStublessClient10

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenProcessToken
OpenThreadToken
GetCurrentProcess
SetThreadStackGuarantee
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount64
GetTickCount

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoWaitForMultipleHandles
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetApartmentType

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
RoOriginateError

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
SetEvent
ReleaseMutex
EnterCriticalSection
CreateMutexExW
CreateEventExW
ReleaseSemaphore
OpenSemaphoreW
InitializeSRWLock
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObjectEx

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

ntdll

RtlImageNtHeader
RtlAllocateHeap
memmove_s
_vsnwprintf
RtlNtStatusToDosError
sprintf_s
memcpy_s
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
LdrDisableThreadCalloutsForDll
RtlFreeHeap
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
wcsncmp
EtwRegisterTraceGuidsW
EtwTraceMessage

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa43943ce8e3b03df3ee539ba3e70d79

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

ntdll

api-ms-win-core-memory-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 266KB - Virtual size: 265KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 264B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 266KB - Virtual size: 265KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 264B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 23KB