TpmCoreProvisioning[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TpmCoreProvisioning.dll
Size

686KB
MD5

b75937f35dc0e66fee6aa25abdcf205b
SHA1

5fe687de256f2c001aa7c86b557aaeb79e7a7dd6
SHA256

8a735a2c4a3c26b09ec5d676c5d0bbb25eac78ce54ce83a1e6ba61726f7be524
SHA512

d2bc9c686d01faad101719d748e7cb31046ce78f7dcdba4a4f524e0a7424fd25850645370876f166ca877241071da5f8217aab634ec316cf043d55ee2a0dc95c
SSDEEP

12288:wNF+x+Li16M+21FtMub/z7sIJhzZkCmJJA:wP+/16M+2Mub/z7sIPZMJ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TpmCoreProvisioning.dll

Files

TpmCoreProvisioning.dll
.dll windows:10 windows x86 arch:x86

b8e1727b4b333670529421402d3c56e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TpmCoreProvisioning.pdb

Imports

msvcp_win

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-string-l1-1-0

memset
strncmp
wcsncpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__fseeki64
_o__get_stream_buffer_pointers
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime32
_o__lock_file
_o__mktime32
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__unlock_file
_o__wcsicmp
_o__wcsnicmp
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fputc
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_mbstowcs_s
_o_memcpy_s
_o_setvbuf
_o_strtoul
_o_terminate
_o_toupper
_o_ungetc
_o_wcscpy_s
_o_wcsftime
_o_wcstoul
_except_handler4_common
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler3
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
memcmp
memcpy

ntdll

AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
ZwClose
RtlAllocateHeap
RtlFreeHeap
ZwAlpcConnectPort
NtPowerInformation
vDbgPrintEx
RtlReleasePrivilege
RtlAcquirePrivilege
TpWaitForAlpcCompletion
RtlWaitOnAddress
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
NtQueryValueKey
NtClose
RtlInitUnicodeString
NtOpenKey
RtlNtStatusToDosError
RtlQueryWnfStateData
RtlCompareMemory
RtlGetPersistedStateLocation
RtlPublishWnfStateData

crypt32

CryptBinaryToStringW
CryptStringToBinaryW
CryptBinaryToStringA
CertGetNameStringW
CertCreateCertificateContext
CertDeleteCertificateFromStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptImportPublicKeyInfoEx2

ncrypt

NCryptDecrypt
BCryptSetProperty
NCryptCreateClaim
BCryptDecrypt
BCryptVerifySignature
BCryptGenRandom
NCryptDeleteKey
NCryptSignHash
NCryptImportKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptGetProperty
NCryptExportKey
NCryptFinalizeKey
NCryptEncrypt
NCryptFreeObject
NCryptOpenKey
NCryptOpenStorageProvider
BCryptGenerateSymmetricKey

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadStringW
GetModuleFileNameW
SizeofResource
LoadResource
GetProcAddress
LockResource
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateMutexW
OpenEventW
WaitForMultipleObjectsEx
LeaveCriticalSection
EnterCriticalSection
SetEvent
InitializeSRWLock
CreateEventExW
DeleteCriticalSection
CreateMutexExW
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
CreateEventW
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenMutexW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSize

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
OpenThreadToken
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegGetValueW
RegDeleteValueW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorLength
IsValidSecurityDescriptor
ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventProviderEnabled
EventSetInformation
EventActivityIdControl
EventUnregister
EventWriteTransfer

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

CreateFileW
CreateDirectoryW
ReadFile
FindFirstFileExW
FindNextFileW
WriteFile
FindClose

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoTaskMemFree
CoWaitForMultipleHandles
CoInitializeEx

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

CopyFile2

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetLocalTime
GetSystemWindowsDirectoryW
GetSystemDirectoryW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoActivateInstance

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-firmware-l1-1-0

GetFirmwareEnvironmentVariableW

winhttp

WinHttpSendRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpQueryDataAvailable

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
SysStringLen

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-threadpool-l1-2-0

CreateThreadpool
CloseThreadpool
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

devobj

DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjCreateDeviceInfoList
DevObjGetDeviceInterfaceDetail

Exports

Exports

DllCanUnloadNow
Tpm20CanClearUsingAuthPolicy
Tpm20ClearUsingAuthPolicy
Tpm20GetCompleteManufacturerVersion
Tpm20IsResetLockoutCountNeeded
Tpm20ResetLockoutCountIfNeeded
Tpm2CreateWindowsNvBits
Tpm2ReadWindowsNvBit
Tpm2SetWindowsNvBit
TpmAddBlockedCommand
TpmCertCheckEkCertMatchedEkPub
TpmCertDeleteHealthCert
TpmCertDeleteHealthEndpoint
TpmCertGetCurrentProtocolVersion
TpmCertGetEkCertFromWeb
TpmCertGetFormattedUrl
TpmCertGetFwLinkId
TpmCertGetHASProtocolVersion
TpmCertGetHealthCert
TpmCertGetHealthCertFromWeb
TpmCertGetHealthCorrelationId
TpmCertGetHealthEndpoint
TpmCertGetHealthForceRetrieve
TpmCertGetHealthStatusCode
TpmCertGetHealthStatusRequestBlob
TpmCertGetIsActiveZeroExhaust
TpmCertGetMaximumSupportedProtocolVersion
TpmCertGetPreferredMaximumProtocolVersion
TpmCertGetTpmManufacturerId
TpmCertGetTpmManufacturerId12
TpmCertGetUrlForFwlinkId
TpmCertGetWindowsAik
TpmCertInstallEkCertInRegistry
TpmCertInstallNvEkCerts
TpmCertIsHealthCertOnBootEnabled
TpmCertParseHealthResponse
TpmCertPostHealthXmlData
TpmCertQueryEkPub
TpmCertSetEkAttestationOverride
TpmCertSetHealthEndpoint
TpmCertSetHealthForceRetrieve
TpmCertSetHealthStatusCode
TpmCertSetPreferredMaximumProtocolVersion
TpmCertVerifyHealthCertFromWeb
TpmChangeOwnerAuth
TpmCheckCreateWindowsAIK
TpmCheckIFXRSAKeyGenVulnerability
TpmClear
TpmClearUsingPhysicalPresence
TpmClearWithPolicyOrPPI
TpmConvertToOwnerAuth
TpmCopyFirmwareVersionFromNvToRegistry
TpmCreateEndorsementKeyPair
TpmCreateHealthAttestationClaim
TpmCreateHealthStatusClaim
TpmDeleteOwnerAuth
TpmDisable
TpmDisableAutoProvisioning
TpmEKCertValidateAndCleanup
TpmEnable
TpmEnableAutoProvisioning
TpmGatherLogs
TpmGatherTpmData
TpmGetCapLockoutInfo
TpmGetDeviceInformation
TpmGetDictionaryAttackParameters
TpmGetEndorsementKeyCertificateState
TpmGetHealthCertRequest
TpmGetOrderlyShutdownInfo
TpmGetOwnerAuth
TpmGetOwnerAuthForEscrow
TpmGetOwnerAuthStatus
TpmGetOwnershipAuthBits
TpmGetPPIVersion
TpmGetPhysicalPresenceConfirmationStatus
TpmGetPhysicalPresenceRequest
TpmGetPhysicalPresenceResponse
TpmGetPhysicalPresenceTransition
TpmGetPssSalt
TpmGetRandomAuthValue
TpmGetSignedEKFromVendorCommand
TpmGetSrkADThumbprint
TpmGetSrkPublicKeyModulus
TpmGetTcgLog
TpmGetTpmVersion
TpmGetVerificationRequest
TpmGet_IsActivated_InitialValue
TpmGet_IsEnabled_InitialValue
TpmGet_IsOwned_InitialValue
TpmGet_IsPpiVersion12
TpmGet_IsTpmPresent
TpmGet_IsTpmVersion20
TpmGet_ManufacturerId
TpmGet_ManufacturerVersion
TpmGet_ManufacturerVersionInfo
TpmGet_PhysicalPresenceVersionInfo
TpmGet_SpecVersion
TpmGet_TpmVersionInfo
TpmHasVulnerableFW
TpmHealthCertGetAndVerify
TpmImportOwnerAuth
TpmIsActivated
TpmIsAutoProvisioningEnabled
TpmIsCommandBlocked
TpmIsCommandPresent
TpmIsEnabled
TpmIsEndorsementKeyPairPresent
TpmIsFIPS
TpmIsKeyAttestationCapable
TpmIsLockedOut
TpmIsOwned
TpmIsOwnerClearDisabled
TpmIsOwnershipAllowed
TpmIsPhysicalClearDisabled
TpmIsPhysicalPresenceHardwareEnabled
TpmIsReady
TpmIsReadyInformation
TpmIsSrkAuthCompatible
TpmIsUseLegacyDictionaryAttackParametersPolicySet
TpmManufacturerId_From_TpmVersionInfo
TpmManufacturerVersionInfo_From_TpmVersionInfo
TpmManufacturerVersion_From_TpmVersionInfo
TpmOwnerAuthEscrowed
TpmPrepForNgc
TpmProvision
TpmRemoveBlockedCommand
TpmRemoveRegisteredWindowsAIK
TpmResetAuthLockOut
TpmResetSrkAuth
TpmRetrieveEkCertOrReschedule
TpmRetrieveEkCertificate
TpmRetrieveHealthCertOrReschedule
TpmRetrieveHealthCertificate
TpmSelfTest
TpmSetDictionaryAttackParameters
TpmSetInstance
TpmSetPhysicalPresenceRequest
TpmSetPhysicalPresenceRequestEx
TpmSetToLegacyDictionaryAttackParameters
TpmSpecVersion_From_TpmVersionInfo
TpmTakeOwnership
TpmUnattendedSetup
TpmVerifyDeviceHealth
TpmWriteInformationSnapshotFile

Sections

.text
Size: 639KB - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8e1727b4b333670529421402d3c56e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

crypt32

ncrypt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

rpcrt4

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-firmware-l1-1-0

winhttp

api-ms-win-core-libraryloader-l1-2-1

oleaut32

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

devobj

Exports

Exports

Sections

.text Size: 639KB - Virtual size: 638KB

.data Size: 3KB - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 212B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 639KB - Virtual size: 638KB

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 212B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 24KB - Virtual size: 23KB