drprov[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

drprov.dll
Size

27KB
MD5

8086ed517c61ecf98843047449b9a7c2
SHA1

369370103504c5a7ec22b0c3d66b3e5d8cb83b55
SHA256

2fcc9a722246da4c613c25af585ac395a78ac043f818982ac67d44f9fc25380e
SHA512

987c1b6377a893bc1a7487311ed062a70266cca3da79af24b6a6a45555f2c3449f8b40e4540d2ab9c2e8319f52141810eda89df0e985e213f913fb50e8008ef1
SSDEEP

384:lYts0rDtaZErewaAKbqoj3GUhjWAIcqvaPIQIwOirs2zRyQ2ql8ch6JJW+dUW:MNDsZEFcjphjyw1K2zwQ2ql8cI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
drprov.dll

Files

drprov.dll
.dll windows:6 windows x64 arch:x64

581153dec6a0676ab9514346bb14149e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

drprov.pdb

Imports

msvcrt

__C_specific_handler
_initterm
malloc
_amsg_exit
wcschr
_XcptFilter
_vsnwprintf
wcsstr
wcsrchr
_wcsnicmp
free
memcpy

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtOpenFile
RtlInitUnicodeString
NtClose
NtCreateFile
RtlAppendUnicodeToString
NtFsControlFile
NtQueryAttributesFile

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-1

QueryDosDeviceW
DefineDosDeviceW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

kernel32

Sleep

winsta

WinStationIsSessionRemoteable

Exports

Exports

NPAddConnection
NPAddConnection3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPGetCaps
NPGetConnection
NPGetConnectionPerformance
NPGetResourceInformation
NPGetResourceParent
NPGetUniversalName
NPOpenEnum

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

581153dec6a0676ab9514346bb14149e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

kernel32

winsta

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 64B

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 64B