cryptbase[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cryptbase.dll
Size

30KB
MD5

b00594d21464d241b064e1500b5d18ea
SHA1

9367b59420cec33f6586dda2927844a16b76d080
SHA256

11eccd15dc910b3fc0517b620ef972bdcd09f7730e8ec777947038dc0f45e77d
SHA512

e0b7998bb5247c5802425fb106cb4f98c816052eb65921a9710d2769eb6da4b49e127fda34575685d83d5aa940c5d6dbf72e16974f017a0eacccb8dd8e7b2c4b
SSDEEP

384:uYawAWR2DTcVD5FspGVf2N+N63KSaQPfWlIWygDBRJv6lSlV11+:uzq0cVDrvVf2l3KSaG631Pilwr+

Score

1^/10

Malware Config

Signatures

Files

cryptbase.dll
.dll windows:6 windows x64 arch:x64

dc096f67f5195b7f036059b8d02e9d15

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/07/2014, 20:32

Not After

01/10/2015, 20:32

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:1d:05:14:be:5b:a4:7c:3e:9e:3c:be:67:e8:30:90:04:55:00:b3:9f:ee:9d:62:b1:ec:1f:05:cd:38:19:9a
Signer

Actual PE Digest

3c:1d:05:14:be:5b:a4:7c:3e:9e:3c:be:67:e8:30:90:04:55:00:b3:9f:ee:9d:62:b1:ec:1f:05:cd:38:19:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

cryptbase.pdb

Imports

ntdll

RtlAllocateHeap
NtWaitForSingleObject
RtlAppendUnicodeStringToString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtDeviceIoControlFile
NtOpenFile
NtQueryInformationToken
RtlCopyUnicodeString
RtlCompareMemory
NtClose
NtOpenThreadToken
NtFsControlFile
RtlInitUnicodeString
RtlFreeHeap

bcryptprimitives

ProcessPrng

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

SystemFunction001
SystemFunction002
SystemFunction003
SystemFunction004
SystemFunction005
SystemFunction028
SystemFunction029
SystemFunction034
SystemFunction036
SystemFunction040
SystemFunction041

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc096f67f5195b7f036059b8d02e9d15

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4eCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

3c:1d:05:14:be:5b:a4:7c:3e:9e:3c:be:67:e8:30:90:04:55:00:b3:9f:ee:9d:62:b1:ec:1f:05:cd:38:19:9aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

bcryptprimitives

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 864B

.idata Size: 2KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 80B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 68B

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

3c:1d:05:14:be:5b:a4:7c:3e:9e:3c:be:67:e8:30:90:04:55:00:b3:9f:ee:9d:62:b1:ec:1f:05:cd:38:19:9a
Signer

.text
Size: 15KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 864B

.idata
Size: 2KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 80B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 68B