SmartcardCredentialProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SmartcardCredentialProvider.dll
Size

626KB
MD5

a46903dfffb641974180535bf16c99ee
SHA1

c8cdefe9b3f9ad044dd4afcf6fcedf68a06b3b34
SHA256

e5dd5b4613171f85755513f141f7de35e21b5a9f1b73f9689df318e95619847c
SHA512

b01e3cd230778ff352e0df5e5fa2311a2fbf05a290757d4806c110291858da8209610eb780ba1bfb500afb242c3bc234350e202873d1a49ee613c07bd5cd2bba
SSDEEP

6144:Dt1DEi7n5NrnLMEYgThByZlAceh7xnmUnnxgDf5fHDbBOUqMYgx9Qzfb36PxRKfo:DtOi7nzrLOgumGE8RfBOYxK31fWF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SmartcardCredentialProvider.dll

Files

SmartcardCredentialProvider.dll
.dll windows:10 windows x86 arch:x86

0d470089a73d0cf697f88f7fd5c26592

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SmartcardCredentialProvider.pdb

Imports

msvcp_win

?_Xout_of_range@std@@YAXPBD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_malloc
_o_towupper
_o_wcscpy_s
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
wcsrchr
wcschr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
LockResource
LoadStringW
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExW
FindResourceExW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
WaitForMultipleObjectsEx
CreateSemaphoreExW
LeaveCriticalSection
CancelWaitableTimer
InitializeCriticalSectionAndSpinCount
CreateMutexExW
InitializeCriticalSection
DeleteCriticalSection
CreateWaitableTimerExW
OpenSemaphoreW
WaitForSingleObjectEx
SetWaitableTimer
ReleaseSemaphore
CreateEventW
ReleaseMutex
ResetEvent
WaitForSingleObject
SetEvent

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
GetCurrentThreadId
ResumeThread
TerminateProcess
GetCurrentProcess
OpenThreadToken
SetThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
FormatMessageW
GetSystemDefaultLCID
GetThreadLocale
LocaleNameToLCID

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage
RegisterTraceGuidsW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExA
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyExW
RegCloseKey
RegCreateKeyExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegGetValueW
RegSetValueExW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl

api-ms-win-security-credentials-l1-1-0

CredReadDomainCredentialsW
CredIsProtectedW
CredFree
CredWriteW
CredMarshalCredentialW
CredProtectW

api-ms-win-security-base-l1-1-0

EqualSid
ImpersonateLoggedOnUser
GetTokenInformation
RevertToSelf
IsValidSid
CopySid
GetLengthSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringW

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
CreateThreadpoolWork
SetThreadpoolWait
CloseThreadpool
CloseThreadpoolWait
TrySubmitThreadpoolCallback
CreateThreadpool
SetEventWhenCallbackReturns
CreateThreadpoolCleanupGroup
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SubmitThreadpoolWork

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-downlevel-shlwapi-l1-1-1

QISearch

ntdll

RtlImageNtHeader
RtlInitializeCriticalSection
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlGetActiveConsoleId
RtlInitString
RtlNtStatusToDosError
RtlFreeUnicodeString

kernel32

RegisterWaitForSingleObject
VirtualProtect
VirtualAlloc
UnregisterWaitEx
GetSystemInfo
GlobalUnlock
GlobalLock
lstrlenW
SetThreadStackGuarantee
VirtualQuery

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 532KB - Virtual size: 531KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d470089a73d0cf697f88f7fd5c26592

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-1

ntdll

kernel32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 532KB - Virtual size: 531KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 488B

.rsrc Size: 43KB - Virtual size: 42KB

.reloc Size: 37KB - Virtual size: 36KB

.text
Size: 532KB - Virtual size: 531KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 488B

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 37KB - Virtual size: 36KB