wintrust[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

wintrust.dll
Size

373KB
MD5

b7a38368a52ff07d875e6465bd7ee26a
SHA1

99d5ea14e5ef16fc997e09f681eaad39bc5c6f61
SHA256

8c6c791e8db8728f9a610def238c61be054bfa3de487bf6ab037130a61a3ef19
SHA512

5a3b474f6b8731067f3a149fde53f9216cb8fb81ef5bb0aa4a622c7ceb7c4b8b65fdb91167d2a179b8c4e52a3761a42f5d06ddca2d935704d33db6f0ad7b3275
SSDEEP

6144:pmCBP6xz5/RZdpcIJJlmWnoBdM6DxlWGqrJvuxS2WeTwNLZLV/M9iQZoBNmlK/oW:UkPY/Vpc0JHWDxlRqb5qK/R

Score

1^/10

Malware Config

Signatures

Files

wintrust.dll
.dll regsvr32 windows:10 windows x64 arch:x64

535395085773d709ddd7a1de7e97336e

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:1b:45:7f:40:34:c4:36:93:aa:5a:c2:fb:34:d9:e0:0d:89:d2:dc:44:5f:d5:77:17:9a:a1:9a:9f:c5:3d:1e
Signer

Actual PE Digest

b6:1b:45:7f:40:34:c4:36:93:aa:5a:c2:fb:34:d9:e0:0d:89:d2:dc:44:5f:d5:77:17:9a:a1:9a:9f:c5:3d:1e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wintrust.pdb

Imports

msvcrt

__dllonexit
_onexit
_lock
_unlock
__C_specific_handler
memset
memmove
memcpy
memcmp
qsort_s
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnwprintf
_wcsicmp
atol
strcmp
__CxxFrameHandler3
memcpy_s
qsort
wcschr
wcstol
_itow_s
_memicmp
_stricmp
_wcsnicmp
wcsrchr
wcscat_s
_wtol
towupper
_vsnprintf
_ltoa
bsearch
wcscmp

api-ms-win-core-version-private-l1-1-0

GetFileVersionInfoByHandle

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
CreateFileW
SetFilePointerEx
CompareFileTime
ReadFile
WriteFile
CreateDirectoryW
SetEndOfFile
GetFileSize
SetFilePointer
GetFileAttributesW
FindClose
GetFileInformationByHandle
FindNextFileW
GetFileSizeEx
SetFileAttributesW
FindFirstFileW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ResetEvent
DeleteCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSection
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GetCurrentDirectoryW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetProcAddress
FreeLibrary
LoadResource
LockResource
GetModuleHandleExA
FreeResource
DisableThreadLibraryCalls
SizeofResource

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExA
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
RegSetValueExA
RegEnumValueA
RegGetValueW
RegQueryValueExA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLocalTime
GetTickCount
GetSystemDirectoryW
GetTickCount64
GetSystemInfo

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-memory-l1-1-1

VirtualUnlock

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-datetime-l1-1-0

GetDateFormatA
GetTimeFormatA

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-security-base-l1-1-0

GetSidSubAuthority
EqualSid
GetLengthSid
IsValidSid
AllocateAndInitializeSid
CopySid
GetAclInformation
AddAce
SetFileSecurityW
GetSidIdentifierAuthority
FreeSid
GetTokenInformation
GetFileSecurityW
GetAce
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAccessAllowedAceEx
GetSidSubAuthorityCount
InitializeAcl
InitializeSecurityDescriptor

rpcrt4

RpcStringBindingComposeW
RpcStringFreeW
RpcEpResolveBinding
RpcBindingFree
NdrClientCall3
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-0

FindResourceExA
CreateFileMappingA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrlenA
lstrlenW

ntdll

NtQuerySecurityAttributesToken
NtQueryEaFile
RtlGetVersion
RtlCreateUnicodeString
NtQuerySecurityObject
RtlInitUnicodeString
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlAllocateHeap
LdrResSearchResource
RtlGetAce
RtlCopyUnicodeString
RtlGetNtSystemRoot
RtlInitializeSidEx
RtlEqualSid
RtlGetDaclSecurityDescriptor
RtlFreeUnicodeString
ZwQueryVolumeInformationFile
RtlNtStatusToDosError
NtQuerySystemInformation
RtlFreeHeap

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AddPersonalTrustDBPages
CatalogCompactHashDatabase
ComputeFirstPageHash
ConfigCiFinalPolicy
ConfigCiPackageFamilyNameCheck
CryptCATAdminAcquireContext
CryptCATAdminAcquireContext2
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminCalcHashFromFileHandle2
CryptCATAdminCalcHashFromFileHandle3
CryptCATAdminEnumCatalogFromHash
CryptCATAdminPauseServiceForBackup
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminRemoveCatalog
CryptCATAdminResolveCatalogPath
CryptCATAllocSortedMemberInfo
CryptCATCDFClose
CryptCATCDFEnumAttributes
CryptCATCDFEnumAttributesWithCDFTag
CryptCATCDFEnumCatAttributes
CryptCATCDFEnumMembers
CryptCATCDFEnumMembersByCDFTag
CryptCATCDFEnumMembersByCDFTagEx
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATClose
CryptCATEnumerateAttr
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATFreeSortedMemberInfo
CryptCATGetAttrInfo
CryptCATGetCatAttrInfo
CryptCATGetMemberInfo
CryptCATHandleFromStore
CryptCATOpen
CryptCATPersistStore
CryptCATPutAttrInfo
CryptCATPutCatAttrInfo
CryptCATPutMemberInfo
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetInfo
CryptSIPGetRegWorkingFlags
CryptSIPGetSealedDigest
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPVerifyIndirectData
DllRegisterServer
DllUnregisterServer
DriverCleanupPolicy
DriverFinalPolicy
DriverInitializePolicy
FindCertsByIssuer
GenericChainCertificateTrust
GenericChainFinalProv
GetAuthenticodeSha256Hash
HTTPSCertificateTrust
HTTPSFinalProv
IsCatalogFile
MsCatConstructHashTag
MsCatFreeHashTag
OfficeCleanupPolicy
OfficeInitializePolicy
OpenPersonalTrustDBDialog
OpenPersonalTrustDBDialogEx
SoftpubAuthenticode
SoftpubCheckCert
SoftpubCleanup
SoftpubDefCertInit
SoftpubDllRegisterServer
SoftpubDllUnregisterServer
SoftpubDumpStructure
SoftpubFreeDefUsageCallData
SoftpubInitialize
SoftpubLoadDefUsageCallData
SoftpubLoadMessage
SoftpubLoadSignature
SrpCheckSmartlockerEAandProcessToken
TrustDecode
TrustFindIssuerCertificate
TrustFreeDecode
TrustIsCertificateSelfSigned
TrustOpenStores
WTConvertCertCtxToChainInfo
WTGetBioSignatureInfo
WTGetPluginSignatureInfo
WTGetSignatureInfo
WTHelperCertCheckValidSignature
WTHelperCertFindIssuerCertificate
WTHelperCertIsSelfSigned
WTHelperCheckCertUsage
WTHelperGetAgencyInfo
WTHelperGetFileHandle
WTHelperGetFileHash
WTHelperGetFileName
WTHelperGetKnownUsages
WTHelperGetProvCertFromChain
WTHelperGetProvPrivateDataFromChain
WTHelperGetProvSignerFromChain
WTHelperIsChainedToMicrosoft
WTHelperIsChainedToMicrosoftFromStateData
WTHelperIsInRootStore
WTHelperOpenKnownStores
WTHelperProvDataFromStateData
WTIsFirstConfigCiResultPreferred
WTLogConfigCiScriptEvent
WTLogConfigCiSignerEvent
WTValidateBioSignaturePolicy
WVTAsn1CatMemberInfo2Decode
WVTAsn1CatMemberInfo2Encode
WVTAsn1CatMemberInfoDecode
WVTAsn1CatMemberInfoEncode
WVTAsn1CatNameValueDecode
WVTAsn1CatNameValueEncode
WVTAsn1IntentToSealAttributeDecode
WVTAsn1IntentToSealAttributeEncode
WVTAsn1SealingSignatureAttributeDecode
WVTAsn1SealingSignatureAttributeEncode
WVTAsn1SealingTimestampAttributeDecode
WVTAsn1SealingTimestampAttributeEncode
WVTAsn1SpcFinancialCriteriaInfoDecode
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcIndirectDataContentDecode
WVTAsn1SpcIndirectDataContentEncode
WVTAsn1SpcLinkDecode
WVTAsn1SpcLinkEncode
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
WVTAsn1SpcPeImageDataDecode
WVTAsn1SpcPeImageDataEncode
WVTAsn1SpcSigInfoDecode
WVTAsn1SpcSigInfoEncode
WVTAsn1SpcSpAgencyInfoDecode
WVTAsn1SpcSpAgencyInfoEncode
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcSpOpusInfoEncode
WVTAsn1SpcStatementTypeDecode
WVTAsn1SpcStatementTypeEncode
WinVerifyTrust
WinVerifyTrustEx
WintrustAddActionID
WintrustAddDefaultForUsage
WintrustCertificateTrust
WintrustGetDefaultForUsage
WintrustGetRegPolicyFlags
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustSetDefaultIncludePEPageHashes
WintrustSetRegPolicyFlags
WintrustUserWriteabilityCheck
mscat32DllRegisterServer
mscat32DllUnregisterServer
mssip32DllRegisterServer
mssip32DllUnregisterServer

Sections

.text
Size: 261KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

535395085773d709ddd7a1de7e97336e

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b6:1b:45:7f:40:34:c4:36:93:aa:5a:c2:fb:34:d9:e0:0d:89:d2:dc:44:5f:d5:77:17:9a:a1:9a:9f:c5:3d:1eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-version-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-core-debug-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 261KB - Virtual size: 261KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 13KB - Virtual size: 12KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b6:1b:45:7f:40:34:c4:36:93:aa:5a:c2:fb:34:d9:e0:0d:89:d2:dc:44:5f:d5:77:17:9a:a1:9a:9f:c5:3d:1e
Signer

.text
Size: 261KB - Virtual size: 261KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 13KB - Virtual size: 12KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 1KB - Virtual size: 1KB