SmartcardCredentialProvider[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

SmartcardCredentialProvider.dll
Size

630KB
MD5

d21aa53534239879d9083419acb759be
SHA1

2de0b327990bc824f504b8376bc867a6f1adbd1d
SHA256

7244da7cbf5d770e29df6c32e88ee75a159dd17f40f2f9fd2893a0bdb7b4ef30
SHA512

71b839379a9f690785faf97d1383c14c0c0e3970345af9f9df519cd23a519ab1c8206685de4c400497fa6ef14b4f7a31482dfe1328c0220a111f54967c053764
SSDEEP

12288:tBPgKrMNaXAErneIWiQaz5yty6YiVDWiY:tBPgKrMMXAErneIa7Y4DWF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SmartcardCredentialProvider.dll

Files

SmartcardCredentialProvider.dll
.dll windows:10 windows x86 arch:x86

793d025fcbedc76dc1dd0a9e8dffa644

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SmartcardCredentialProvider.pdb

Imports

msvcp_win

?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Incref@facet@locale@std@@UAEXXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ

api-ms-win-crt-string-l1-1-0

wcsnlen
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_malloc
_o_towupper
_o_wcscpy_s
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
wcsrchr
wcschr
__std_terminate
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
LoadStringW
FreeLibrary
FindResourceExW
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

SetEvent
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ResetEvent
CreateEventW
ReleaseSRWLockExclusive
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
CreateWaitableTimerExW
SetWaitableTimer
CancelWaitableTimer
WaitForMultipleObjectsEx
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

SetEventWhenCallbackReturns
TrySubmitThreadpoolCallback
CloseThreadpoolWait
CreateThreadpoolTimer
CallbackMayRunLong
SetThreadpoolTimer
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpool
CloseThreadpoolTimer
CreateThreadpool
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
CreateThreadpoolWait

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenThreadToken
ResumeThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
SetThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetSystemDefaultLCID
GetUserDefaultLCID
LocaleNameToLCID
GetThreadLocale

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumKeyExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyExW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventActivityIdControl
EventSetInformation
EventWriteTransfer

api-ms-win-security-credentials-l1-1-0

CredIsProtectedW
CredReadDomainCredentialsW
CredMarshalCredentialW
CredFree
CredProtectW
CredWriteW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
IsValidSid
GetLengthSid
EqualSid
CopySid
GetTokenInformation
RevertToSelf

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

rpcrt4

UuidToStringW
UuidFromStringW
RpcStringFreeW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-downlevel-shlwapi-l1-1-0

QISearch

ntdll

RtlInitializeCriticalSection
RtlInitAnsiString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlGetActiveConsoleId
RtlNtStatusToDosError
RtlImageNtHeader
RtlAnsiStringToUnicodeString
RtlInitString

kernel32

UnregisterWaitEx
VirtualProtect
VirtualAlloc
GetSystemInfo
RegisterWaitForSingleObject
GlobalUnlock
GlobalLock
lstrlenW
SetThreadStackGuarantee
VirtualQuery

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 536KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

793d025fcbedc76dc1dd0a9e8dffa644

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

rpcrt4

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-0

ntdll

kernel32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 536KB - Virtual size: 536KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 488B

.rsrc Size: 43KB - Virtual size: 42KB

.reloc Size: 36KB - Virtual size: 36KB

.text
Size: 536KB - Virtual size: 536KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 488B

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 36KB - Virtual size: 36KB