WinSCard[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WinSCard.dll
Size

163KB
MD5

0f826b6715589b99155acd174ee2afe8
SHA1

8c97d310926fa90c04daa438af7642ca8d61a97a
SHA256

2147c2da1f1ee60d250cecb5d4427e3d82051649ac8be68b1be474869dbade65
SHA512

c0ecd571b3ec982ce0859a0eb8b77579e2dc7e45ff8c2c2e762695b6bb643567bfeba097e235bfec6ab1c3423f8868f6b8e048a3ba26cce51615ed11b2ecbd4c
SSDEEP

3072:XM5vsGiAASCugf2PiJbxX3MtptTH8aAmS/k1P7ZLQt:85vsjsCtf2PidxHMTlvAa7ZLC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinSCard.dll

Files

WinSCard.dll
.dll windows:6 windows x86 arch:x86

4958eb732c907d68d73ec39d2baee8e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WinSCard.pdb

Imports

msvcrt

_vsnprintf
wcspbrk
_ultow
??3@YAXPAX@Z
_vsnwprintf
??_V@YAXPAX@Z
??2@YAPAXI@Z
_wcsicmp
_wcsnicmp
_wtoi
_XcptFilter
free
malloc
_initterm
??1type_info@@UAE@XZ
_except_handler4_common
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
??_U@YAPAXI@Z
_amsg_exit
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids

ntdll

NtDeviceIoControlFile
RtlInitializeCriticalSection
RtlDeleteCriticalSection
NtCancelIoFileEx
NtCreateFile
RtlDllShutdownInProgress
RtlInitUnicodeString
EtwTraceMessage

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-1

ReadFile
CreateFileW
GetFileSizeEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
SizeofResource
FreeLibrary
LoadResource
LockResource

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
GetCurrentProcess
GetCurrentThread
GetProcessId
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
OpenProcessToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

CreateEventW
ResetEvent
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
SetEvent
WaitForSingleObject
SleepConditionVariableCS
InitializeConditionVariable
OpenEventW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CreateThreadpoolWait

api-ms-win-security-base-l1-2-0

IsValidSid
GetSidLengthRequired
AddAce
GetTokenInformation
InitializeSid
AddAccessAllowedAce
InitializeAcl
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAclInformation
GetSidSubAuthority
GetLengthSid

rpcrt4

UuidCreate
NdrClientCall2
RpcBindingBind
RpcBindingCreateW
NdrMesTypeEncode2
NdrMesTypeFree2
NdrMesTypeDecode2
MesHandleFree
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
RpcSsDestroyClientContext
RpcBindingFree
UuidToStringW
RpcStringFreeW

devobj

DevObjOpenDeviceInfo
DevObjGetDeviceProperty
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList

kernel32

HeapReAlloc
WaitForMultipleObjects
WakeAllConditionVariable
SetLastError
RegEnumKeyExW
RegDeleteKeyExW
lstrcmpiW
lstrlenW
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrlenA
FindResourceW
lstrcmpW
QueryFullProcessImageNameW
DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

ClassInstall32
SCardAccessNewReaderEvent
SCardAccessStartedEvent
SCardAddReaderToGroupA
SCardAddReaderToGroupW
SCardAudit
SCardBeginTransaction
SCardCancel
SCardConnectA
SCardConnectW
SCardControl
SCardDisconnect
SCardEndTransaction
SCardEstablishContext
SCardForgetCardTypeA
SCardForgetCardTypeW
SCardForgetReaderA
SCardForgetReaderGroupA
SCardForgetReaderGroupW
SCardForgetReaderW
SCardFreeMemory
SCardGetAttrib
SCardGetCardTypeProviderNameA
SCardGetCardTypeProviderNameW
SCardGetDeviceTypeIdA
SCardGetDeviceTypeIdW
SCardGetProviderIdA
SCardGetProviderIdW
SCardGetReaderDeviceInstanceIdA
SCardGetReaderDeviceInstanceIdW
SCardGetReaderIconA
SCardGetReaderIconW
SCardGetStatusChangeA
SCardGetStatusChangeW
SCardGetTransmitCount
SCardIntroduceCardTypeA
SCardIntroduceCardTypeW
SCardIntroduceReaderA
SCardIntroduceReaderGroupA
SCardIntroduceReaderGroupW
SCardIntroduceReaderW
SCardIsValidContext
SCardListCardsA
SCardListCardsW
SCardListInterfacesA
SCardListInterfacesW
SCardListReaderGroupsA
SCardListReaderGroupsW
SCardListReadersA
SCardListReadersW
SCardListReadersWithDeviceInstanceIdA
SCardListReadersWithDeviceInstanceIdW
SCardLocateCardsA
SCardLocateCardsByATRA
SCardLocateCardsByATRW
SCardLocateCardsW
SCardReadCacheA
SCardReadCacheW
SCardReconnect
SCardReleaseAllEvents
SCardReleaseContext
SCardReleaseNewReaderEvent
SCardReleaseStartedEvent
SCardRemoveReaderFromGroupA
SCardRemoveReaderFromGroupW
SCardSetAttrib
SCardSetCardTypeProviderNameA
SCardSetCardTypeProviderNameW
SCardState
SCardStatusA
SCardStatusW
SCardTransmit
SCardWriteCacheA
SCardWriteCacheW
g_rgSCardRawPci
g_rgSCardT0Pci
g_rgSCardT1Pci

Sections

.text
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4958eb732c907d68d73ec39d2baee8e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

rpcrt4

devobj

kernel32

Exports

Exports

Sections

.text Size: 142KB - Virtual size: 141KB

.data Size: 2KB - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 142KB - Virtual size: 141KB

.data
Size: 2KB - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB