cryptui[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cryptui.dll
Size

591KB
MD5

73a3041850703acbc36b8b32961d96b2
SHA1

6a76afa7edd9b7487a72936a886cb7417bc18f62
SHA256

870a5fcb619fa411cc294046691e00143f13c459bc03942e2f66b18f2ed15a13
SHA512

e7b36cf8759d5266fc1a06d59e78be60d6d173eead74573ed351e7273e0ef15071a747a706ff22a38d8161483c43f561ba4b2fe69a2bd00425699cb97784b299
SSDEEP

12288:rh2tOC8awjhOrZim9kMK6mOxGPDbodiljh:rhOOlhEZim9khOIbo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cryptui.dll

Files

cryptui.dll
.dll regsvr32 windows:6 windows x64 arch:x64

9fe7daf3a674ecb91480b41f43f16013

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

cryptui.pdb

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
strcmp
__C_specific_handler
memset
strtok
_stricmp
iswspace
wcschr
wcsrchr
_ltow
_purecall
qsort_s
memcpy
_wtoi
_vsnwprintf
??_V@YAXPEAX@Z
memcmp
swprintf_s
_wcsicmp
memcpy_s
iswprint
__CxxFrameHandler3
memmove
_itow
_vsnprintf
_wcsdup
malloc
free
??3@YAXPEAX@Z
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken
OpenThreadToken
GetCurrentThread
FlushInstructionCache
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW
LoadStringA
GetModuleHandleExW
GetProcAddress
LoadLibraryExA
GetModuleFileNameW
FreeLibrary

api-ms-win-core-file-l1-2-1

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-security-base-l1-2-0

DuplicateToken
GetTokenInformation
IsWellKnownSid

api-ms-win-core-sysinfo-l1-2-1

GetSystemTime
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExA
RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-1

SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

crypt32

CryptEncodeObject
CertOpenStore
CertCompareCertificateName
CryptEnumOIDInfo
CryptBinaryToStringA
CertDeleteCertificateFromStore
CertNameToStrW
CertSaveStore
CertAddSerializedElementToStore
CertEnumCertificatesInStore
CertCompareCertificate
CryptAcquireCertificatePrivateKey
CertFreeCertificateChain
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetStoreProperty
CertFreeCertificateChainEngine
CertGetSubjectCertificateFromStore
CertEnumSystemStore
CertEnumPhysicalStore
CryptFindLocalizedName
CertFreeCTLContext
CryptMsgDuplicate
CryptQueryObject
CryptFormatObject
CryptMsgVerifyCountersignatureEncoded
CryptMsgOpenToDecode
CryptMsgGetParam
CertGetCTLContextProperty
CryptMsgUpdate
CertFindAttribute
CryptMsgClose
CryptMsgControl
CertGetPublicKeyLength
CryptFindOIDInfo
CertFindCertificateInStore
CertDuplicateCertificateContext
CryptEncodeObjectEx
CryptInitOIDFunctionSet
CertDuplicateStore
CryptGetDefaultOIDDllList
CertGetEnhancedKeyUsage
CryptDecodeObjectEx
CryptGetDefaultOIDFunctionAddress
CertGetValidUsages
CryptFreeOIDFunctionAddress
CertSetEnhancedKeyUsage
CertFindExtension
CryptDecodeObject
CertSetCertificateContextProperty
CertGetNameStringW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-datetime-l1-1-1

GetDateFormatW
GetDateFormatEx
GetTimeFormatEx
GetTimeFormatW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapDestroy
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree

api-ms-win-core-interlocked-l1-2-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW
MulDiv
LoadLibraryA

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalFree
GlobalLock
LocalReAlloc
GlobalAlloc
LocalFree
LocalAlloc
GlobalUnlock

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA
lstrcmpiW

api-ms-win-core-sidebyside-l1-1-0

FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
QueryActCtxW

user32

BeginPaint
GetUpdateRect
SetWindowPos
PostMessageA
LoadBitmapA
GetParent
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemTextA
DrawIcon
EndPaint
IsWindowEnabled
SetDlgItemTextA
PeekMessageA
GetWindowDC
MoveWindow
UpdateWindow
ReleaseCapture
CreateWindowExW
SetWindowTextW
EnableWindow
DrawFocusRect
GetClientRect
GetFocus
SetCapture
GetNextDlgTabItem
GetActiveWindow
LoadIconW
ScreenToClient
DefWindowProcW
SendMessageW
CallWindowProcW
SetClipboardData
OpenClipboard
EmptyClipboard
LoadCursorW
GetKeyState
CloseClipboard
GetWindowTextLengthW
DestroyWindow
MonitorFromWindow
GetMonitorInfoW
GetWindow
CopyRect
LoadBitmapW
SetRect
MapDialogRect
PostMessageW
SetWindowLongPtrW
GetWindowRect
MessageBoxW
ShowWindow
GetWindowLongPtrA
SetClassLongPtrA
CheckRadioButton
FillRect
IsDlgButtonChecked
GetSysColor
GetDialogBaseUnits
IsWindowVisible
SendDlgItemMessageW
EndDialog
GetDlgItem
GetWindowTextW
SetFocus
LoadIconA
GetWindowLongPtrW
GetDC
InvalidateRect
DialogBoxParamW
ReleaseDC
RegisterClipboardFormatA
GetSysColorBrush
SetWindowLongPtrA
MapWindowPoints
GetDoubleClickTime
CallWindowProcA
SetCursor
MessageBoxExW
DrawTextW
LoadImageW
GetDesktopWindow
GetCursor
LoadCursorA
DestroyIcon
SendDlgItemMessageA
SendMessageA
WinHelpW

gdi32

SelectObject
GetTextExtentPoint32W
GetBkColor
GetObjectA
CreateFontIndirectA
CreateCompatibleBitmap
GetObjectW
CreateFontIndirectW
SetPixel
DeleteObject

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

ACUIProviderInvokeUI
AddChainToStore
CertDllProtectedRootMessageBox
CertSelectionGetSerializedBlob
CommonInit
CompareCertificate
CryptDllProtectPrompt
CryptUIDlgAddPolicyServer
CryptUIDlgAddPolicyServerWithPriority
CryptUIDlgCertMgr
CryptUIDlgFreeCAContext
CryptUIDlgFreePolicyServerContext
CryptUIDlgPropertyPolicy
CryptUIDlgSelectCA
CryptUIDlgSelectCertificateA
CryptUIDlgSelectCertificateFromStore
CryptUIDlgSelectCertificateW
CryptUIDlgSelectPolicyServer
CryptUIDlgSelectStoreA
CryptUIDlgSelectStoreW
CryptUIDlgViewCRLA
CryptUIDlgViewCRLW
CryptUIDlgViewCTLA
CryptUIDlgViewCTLW
CryptUIDlgViewCertificateA
CryptUIDlgViewCertificatePropertiesA
CryptUIDlgViewCertificatePropertiesW
CryptUIDlgViewCertificateW
CryptUIDlgViewContext
CryptUIDlgViewSignerInfoA
CryptUIDlgViewSignerInfoW
CryptUIFreeCertificatePropertiesPagesA
CryptUIFreeCertificatePropertiesPagesW
CryptUIFreeViewSignaturesPagesA
CryptUIFreeViewSignaturesPagesW
CryptUIGetCertificatePropertiesPagesA
CryptUIGetCertificatePropertiesPagesW
CryptUIGetViewSignaturesPagesA
CryptUIGetViewSignaturesPagesW
CryptUIStartCertMgr
CryptUIViewExpiringCerts
CryptUIWizBuildCTL
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIWizFreeDigitalSignContext
CryptUIWizImport
CryptUIWizImportInternal
DisplayHtmlHelp
DllRegisterServer
DllUnregisterServer
FormatDateStringAutoLayout
GetUnknownErrorString
InvokeHelpLink
IsWizardExtensionAvailable
MyFormatEnhancedKeyUsageString

Sections

.text
Size: 257KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mytext
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9fe7daf3a674ecb91480b41f43f16013

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-l1-1-0

crypt32

api-ms-win-core-localization-l1-2-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

user32

gdi32

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 257KB - Virtual size: 257KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 8KB - Virtual size: 8KB

.idata Size: 12KB - Virtual size: 12KB

.didat Size: 1024B - Virtual size: 544B

.mytext Size: 512B - Virtual size: 192B

.rsrc Size: 307KB - Virtual size: 306KB

.reloc Size: 512B - Virtual size: 484B

.text
Size: 257KB - Virtual size: 257KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 8KB - Virtual size: 8KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 1024B - Virtual size: 544B

.mytext
Size: 512B - Virtual size: 192B

.rsrc
Size: 307KB - Virtual size: 306KB

.reloc
Size: 512B - Virtual size: 484B