BitLockerCsp[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

BitLockerCsp.dll
Size

140KB
MD5

5bdfed05c1f3a528ab71f628b1c744bc
SHA1

44a9c732679498643f59d41bf4c50effdb1d4151
SHA256

e93d4fce5c42a65c9e738fcad7f50230cf599b4e4f2b449809619fa25fde0f95
SHA512

cfe5d9e094d0848b6e66077c0d0b4810a94994424569b513103681aadc117beb398884ec2eaa651daf9ea7d787bb810900a63f8e5092c31ca95220edc36cd02a
SSDEEP

3072:ZLzxR2h3yL+SgaOXicLxvpIGvoPE9zb8l5yfvVmV8RW+L/WUZjWrEPM:Zf8yL+baOXicLzIEzGyfvcjfUZjWrEU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BitLockerCsp.dll

Files

BitLockerCsp.dll
.dll windows:10 windows x86 arch:x86

e7e9297bef16c0123aa1a2533934b41e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

BitLockerCSP.pdb

Imports

msvcp110_win

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z

msvcrt

memset
_CxxThrowException
toupper
_wcsnicmp
_wtoi
_wcsicmp
memcmp
memcpy
memmove
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
__CxxFrameHandler3

ntdll

NtGetCachedSigningLevel
NtQuerySystemInformation
NtQueryInformationToken
NtDuplicateToken
NtOpenProcessToken
NtOpenThreadToken
RtlEqualSid
RtlSubAuthorityCountSid
RtlGetDeviceFamilyInfoEnum
RtlCopySid
RtlLengthSid
RtlGetNtProductType
RtlInitUnicodeString
RtlSubAuthoritySid
RtlInitializeSid
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlCompareMemory
RtlNtStatusToDosError
RtlIsMultiSessionSku
NtClose

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventProviderEnabled
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionEx
CreateMutexExW
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegQueryValueExA
RegUnLoadKeyW
RegLoadKeyW
RegOpenKeyExW
RegGetValueW
RegDeleteValueW
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
PrivilegeCheck
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
GetTokenInformation
CopySid
GetLengthSid

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

bcd

BcdCloseStore
BcdOpenSystemStore
BcdEnumerateObjects
BcdEnumerateAndUnpackElements
BcdCloseObject
BcdOpenObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7e9297bef16c0123aa1a2533934b41e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-heap-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

bcd

Exports

Exports

Sections

.text Size: 122KB - Virtual size: 121KB

.data Size: 2KB - Virtual size: 4KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 244B

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 122KB - Virtual size: 121KB

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 244B

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 7KB - Virtual size: 6KB