UserDeviceRegistration[.]Ngc[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

UserDeviceRegistration.Ngc.dll
Size

196KB
MD5

fce3c645642f12c745437b3228fa73fc
SHA1

bd5d5731f13eec4755524431ec1569a99952cda7
SHA256

79f56934aba30e24899f5a26c6129cd09763c8807114a0ef768290fdfa50ef12
SHA512

9f943bd818f9051e875ccb8db11e0117a2e9c49130f6d85441a3956e91a8feb76ba3a4366f43f753070651ae736171109c73447e25a6dc2b814c8c620856ee71
SSDEEP

6144:hC96feZU7F+WCMhP4GrncbNla1tZ3eFM:MZwvhP4GrncbNMngF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UserDeviceRegistration.Ngc.dll

Files

UserDeviceRegistration.Ngc.dll
.dll windows:10 windows x86 arch:x86

6374d49e88cf8768ae6ec13bca49a377

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

UserDeviceRegistration.Ngc.pdb

Imports

msvcrt

memcmp
_except_handler4_common
_onexit
_callnewh
__dllonexit
_unlock
_lock
wcsstr
__CxxFrameHandler3
_initterm
malloc
memcpy_s
_amsg_exit
_vsnwprintf
_ftol2
_XcptFilter
free
_purecall
memset

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateString
WindowsDeleteString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsConcatString
HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserFree
HSTRING_UserUnmarshal
WindowsStringHasEmbeddedNull
WindowsGetStringLen

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetCallerTID
CoWaitForMultipleHandles
CoGetCallContext
CoCreateGuid
CoCreateInstance
StringFromGUID2

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW
GetRestrictedErrorInfo

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
CreateSemaphoreExW
AcquireSRWLockExclusive
InitializeSRWLock
CreateEventExW
ReleaseSRWLockShared
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
ReleaseMutex
CreateEventW

rpcrt4

NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
UuidIsNil
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
UuidFromStringW
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
NdrDllGetClassObject
CStdStubBuffer_DebugServerQueryInterface
IUnknown_QueryInterface_Proxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_DebugServerRelease

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient22
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient15
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient14
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient12
ObjectStublessClient24
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient25
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient16
CStdStubBuffer2_Connect
ObjectStublessClient21
NdrProxyForwardingFunction3

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetProcessId
GetCurrentProcessId
OpenProcessToken
GetCurrentThread
OpenThreadToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

ntdll

LdrDisableThreadCalloutsForDll
RtlImageNtHeader

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetLengthSid
CopySid

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegCreateKeyExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

crypt32

CertVerifySubjectCertificateContext
CertFreeCertificateContext

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory
RoUninitialize
RoActivateInstance

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

twinapi.appcore

ord2
ord3

cryptngc

NgcGetUserIdKeyCertificate

webauthn

WebAuthNCtapResetDevice

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

winhttp

WinHttpCrackUrl

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6374d49e88cf8768ae6ec13bca49a377

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

crypt32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

twinapi.appcore

cryptngc

webauthn

api-ms-win-security-sddl-l1-1-0

winhttp

Exports

Exports

Sections

.text Size: 174KB - Virtual size: 174KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 112B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 174KB - Virtual size: 174KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 112B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB