PCPKsp[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

PCPKsp.dll
Size

51KB
MD5

3fe728734e63e8bd791fd7bd87962731
SHA1

3c98bbfa94192142e00920fae799cc445a11ba69
SHA256

5a26b3a1e4c184c95dc3712d727592458893cd8ba6035b4bddc1f426e5eca40d
SHA512

3b00e4a5a47d0ee0812451b15c6c63fd48c99626e0319ebe773398999d176ec652a6e0f930cc9cdcf7b853fbd9e7ea2dcef9d208588e39568baec1419e6ae491
SSDEEP

1536:cCMDuN6jJuZpl4KGzV33L9wRGhTngw04:0uNufzV33LmRyTngv4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PCPKsp.dll

Files

PCPKsp.dll
.dll windows:6 windows x86 arch:x86

3e442e9b1d8741e0b8dca4c71d49c589

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PCPKsp.pdb

Imports

ntdll

NtRollbackTransaction
NtCommitTransaction
NtCreateTransaction
RtlUnhandledExceptionFilter
_vsnwprintf
NtTerminateProcess
memcpy
memset

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegGetValueW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
LoadStringW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

GetLastError

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection

bcrypt

BCryptExportKey
BCryptFinalizeKeyPair
BCryptRegisterProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyKey
BCryptUnregisterProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptGenerateKeyPair
BCryptFinishHash
BCryptHashData
BCryptCreateHash

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken
OpenThreadToken
GetCurrentProcess
GetCurrentThread

api-ms-win-core-file-l1-2-1

DeleteFileW
WriteFile
FindFirstFileW
FindNextFileW
GetFileSize
FindClose
CreateFileW
GetFileAttributesW
CreateDirectoryW
GetFileAttributesExW
ReadFile
GetFileTime

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-2-0

GetSecurityDescriptorSacl
GetSecurityDescriptorGroup
AccessCheck
MapGenericMask
DuplicateToken
GetSecurityDescriptorLength
GetTokenInformation
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner

api-ms-win-core-handle-l1-1-0

CloseHandle

crypt32

CryptProtectData
CryptUnprotectData
CertOpenStore
CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore

ncrypt

NCryptDeleteKey
NCryptGetProperty
NCryptExportKey
NCryptOpenStorageProvider
NCryptImportKey
NCryptFinalizeKey
NCryptSetProperty
NCryptFreeObject

api-ms-win-core-sysinfo-l1-2-1

GetSystemDirectoryW

userenv

GetAppContainerRegistryLocation

api-ms-win-core-registry-l2-1-0

RegSetKeyValueW

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW
GetNamedSecurityInfoW

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW
CreateFileTransactedW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

Exports

Exports

DllInstall
DllMain
DllUnregisterServer
GetAsymmetricEncryptionInterface
GetKeyStorageInterface
GetRngInterface

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e442e9b1d8741e0b8dca4c71d49c589

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

bcrypt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

crypt32

ncrypt

api-ms-win-core-sysinfo-l1-2-1

userenv

api-ms-win-core-registry-l2-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-shell-shellfolders-l1-1-0

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 42KB

.data Size: 512B - Virtual size: 948B

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 42KB - Virtual size: 42KB

.data
Size: 512B - Virtual size: 948B

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB