wintrust[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wintrust.dll
Size 373KB
Sample261029-2mppaatvcw
SHA256 8c6c791e8db8728f9a610def238c61be054bfa3de487bf6ab037130a61a3ef19
MD5 b7a38368a52ff07d875e6465bd7ee26a
SHA1 99d5ea14e5ef16fc997e09f681eaad39bc5c6f61
SHA512 5a3b474f6b8731067f3a149fde53f9216cb8fb81ef5bb0aa4a622c7ceb7c4b8b65fdb91167d2a179b8c4e52a3761a42f5d06ddca2d935704d33db6f0ad7b3275
SSDEEP 6144:pmCBP6xz5/RZdpcIJJlmWnoBdM6DxlWGqrJvuxS2WeTwNLZLV/M9iQZoBNmlK/oW:UkPY/Vpc0JHWDxlRqb5qK/R
TLSH
T1C3844A2EA6F910A4D8B6913885538206D6737874237196CF429CC6BD9F2BFE47A3DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
wintrust.dll

File Explorer

wintrust.dll

.dll 373KB

wintrust.dll

IMPHASH 535395085773d709ddd7a1de7e97336e
SHA256 8c6c791e8db8728f9a610def238c61be054bfa3de487bf6ab037130a61a3ef19
MD5 b7a38368a52ff07d875e6465bd7ee26a
SHA1 99d5ea14e5ef16fc997e09f681eaad39bc5c6f61
SHA512 5a3b474f6b8731067f3a149fde53f9216cb8fb81ef5bb0aa4a622c7ceb7c4b8b65fdb91167d2a179b8c4e52a3761a42f5d06ddca2d935704d33db6f0ad7b3275
SSDEEP 6144:pmCBP6xz5/RZdpcIJJlmWnoBdM6DxlWGqrJvuxS2WeTwNLZLV/M9iQZoBNmlK/oW:UkPY/Vpc0JHWDxlRqb5qK/R
TLSH
T1C3844A2EA6F910A4D8B6913885538206D6737874237196CF429CC6BD9F2BFE47A3DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b6:1b:45:7f:40:34:c4:36:93:aa:5a:c2:fb:34:d9:e0:0d:89:d2:dc:44:5f:d5:77:17:9a:a1:9a:9f:c5:3d:1e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2020

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

69824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

wintrust.pdb

msvcrt

__dllonexit _onexit _lock _unlock __C_specific_handler memset memmove memcpy memcmp qsort_s _initterm _amsg_exit _XcptFilter _callnewh malloc free _vsnwprintf _wcsicmp atol strcmp __CxxFrameHandler3 memcpy_s qsort wcschr wcstol _itow_s _memicmp _stricmp _wcsnicmp wcsrchr wcscat_s _wtol towupper _vsnprintf _ltoa bsearch wcscmp

api-ms-win-core-version-private-l1-1-0

GetFileVersionInfoByHandle

api-ms-win-core-file-l1-1-0

GetFileAttributesExW CreateFileW SetFilePointerEx CompareFileTime ReadFile WriteFile CreateDirectoryW SetEndOfFile GetFileSize SetFilePointer GetFileAttributesW FindClose GetFileInformationByHandle FindNextFileW GetFileSizeEx SetFileAttributesW FindFirstFileW

api-ms-win-core-errorhandling-l1-1-0

GetLastError UnhandledExceptionFilter SetLastError SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

WaitForSingleObject ResetEvent DeleteCriticalSection LeaveCriticalSection SetEvent ReleaseSRWLockExclusive EnterCriticalSection InitializeCriticalSection ReleaseMutex WaitForMultipleObjectsEx CreateMutexA CreateEventA ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalReAlloc LocalFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventSetInformation EventRegister EventUnregister

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetEnvironmentVariableW GetEnvironmentVariableA ExpandEnvironmentStringsA GetCurrentDirectoryW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA GetProcAddress FreeLibrary LoadResource LockResource GetModuleHandleExA FreeResource DisableThreadLibraryCalls SizeofResource

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyA RegOpenKeyExA RegQueryValueExW RegEnumKeyExA RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegDeleteKeyExW RegCloseKey RegSetValueExA RegEnumValueA RegGetValueW RegQueryValueExA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapFree

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetLocalTime GetTickCount GetSystemDirectoryW GetTickCount64 GetSystemInfo

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile CreateFileMappingW MapViewOfFile

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentProcess TerminateProcess OpenThreadToken OpenProcessToken GetCurrentThreadId GetCurrentThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-memory-l1-1-1

VirtualUnlock

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-datetime-l1-1-0

GetDateFormatA GetTimeFormatA

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-security-base-l1-1-0

GetSidSubAuthority EqualSid GetLengthSid IsValidSid AllocateAndInitializeSid CopySid GetAclInformation AddAce SetFileSecurityW GetSidIdentifierAuthority FreeSid GetTokenInformation GetFileSecurityW GetAce GetSecurityDescriptorDacl SetSecurityDescriptorDacl AddAccessAllowedAceEx GetSidSubAuthorityCount InitializeAcl InitializeSecurityDescriptor

rpcrt4

RpcStringBindingComposeW RpcStringFreeW RpcEpResolveBinding RpcBindingFree NdrClientCall3 RpcBindingFromStringBindingW RpcBindingSetAuthInfoExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-0

FindResourceExA CreateFileMappingA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA lstrlenA lstrlenW

ntdll

NtQuerySecurityAttributesToken NtQueryEaFile RtlGetVersion RtlCreateUnicodeString NtQuerySecurityObject RtlInitUnicodeString RtlCompareUnicodeString RtlAppendUnicodeStringToString RtlEqualUnicodeString RtlPrefixUnicodeString RtlAllocateHeap LdrResSearchResource RtlGetAce RtlCopyUnicodeString RtlGetNtSystemRoot RtlInitializeSidEx RtlEqualSid RtlGetDaclSecurityDescriptor RtlFreeUnicodeString ZwQueryVolumeInformationFile RtlNtStatusToDosError NtQuerySystemInformation RtlFreeHeap

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

AddPersonalTrustDBPages CatalogCompactHashDatabase ComputeFirstPageHash ConfigCiFinalPolicy ConfigCiPackageFamilyNameCheck CryptCATAdminAcquireContext CryptCATAdminAcquireContext2 CryptCATAdminAddCatalog CryptCATAdminCalcHashFromFileHandle CryptCATAdminCalcHashFromFileHandle2 CryptCATAdminCalcHashFromFileHandle3 CryptCATAdminEnumCatalogFromHash CryptCATAdminPauseServiceForBackup CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminRemoveCatalog CryptCATAdminResolveCatalogPath CryptCATAllocSortedMemberInfo CryptCATCDFClose CryptCATCDFEnumAttributes CryptCATCDFEnumAttributesWithCDFTag CryptCATCDFEnumCatAttributes CryptCATCDFEnumMembers CryptCATCDFEnumMembersByCDFTag CryptCATCDFEnumMembersByCDFTagEx CryptCATCDFOpen CryptCATCatalogInfoFromContext CryptCATClose CryptCATEnumerateAttr CryptCATEnumerateCatAttr CryptCATEnumerateMember CryptCATFreeSortedMemberInfo CryptCATGetAttrInfo CryptCATGetCatAttrInfo CryptCATGetMemberInfo CryptCATHandleFromStore CryptCATOpen CryptCATPersistStore CryptCATPutAttrInfo CryptCATPutCatAttrInfo CryptCATPutMemberInfo CryptCATStoreFromHandle CryptCATVerifyMember CryptSIPCreateIndirectData CryptSIPGetCaps CryptSIPGetInfo CryptSIPGetRegWorkingFlags CryptSIPGetSealedDigest CryptSIPGetSignedDataMsg CryptSIPPutSignedDataMsg CryptSIPRemoveSignedDataMsg CryptSIPVerifyIndirectData DllRegisterServer DllUnregisterServer DriverCleanupPolicy DriverFinalPolicy DriverInitializePolicy FindCertsByIssuer GenericChainCertificateTrust GenericChainFinalProv GetAuthenticodeSha256Hash HTTPSCertificateTrust HTTPSFinalProv IsCatalogFile MsCatConstructHashTag MsCatFreeHashTag OfficeCleanupPolicy OfficeInitializePolicy OpenPersonalTrustDBDialog OpenPersonalTrustDBDialogEx SoftpubAuthenticode SoftpubCheckCert SoftpubCleanup SoftpubDefCertInit SoftpubDllRegisterServer SoftpubDllUnregisterServer SoftpubDumpStructure SoftpubFreeDefUsageCallData SoftpubInitialize SoftpubLoadDefUsageCallData SoftpubLoadMessage SoftpubLoadSignature SrpCheckSmartlockerEAandProcessToken TrustDecode TrustFindIssuerCertificate TrustFreeDecode TrustIsCertificateSelfSigned TrustOpenStores WTConvertCertCtxToChainInfo WTGetBioSignatureInfo WTGetPluginSignatureInfo WTGetSignatureInfo WTHelperCertCheckValidSignature WTHelperCertFindIssuerCertificate WTHelperCertIsSelfSigned WTHelperCheckCertUsage WTHelperGetAgencyInfo WTHelperGetFileHandle WTHelperGetFileHash WTHelperGetFileName WTHelperGetKnownUsages WTHelperGetProvCertFromChain WTHelperGetProvPrivateDataFromChain WTHelperGetProvSignerFromChain WTHelperIsChainedToMicrosoft WTHelperIsChainedToMicrosoftFromStateData WTHelperIsInRootStore WTHelperOpenKnownStores WTHelperProvDataFromStateData WTIsFirstConfigCiResultPreferred WTLogConfigCiScriptEvent WTLogConfigCiSignerEvent WTValidateBioSignaturePolicy WVTAsn1CatMemberInfo2Decode WVTAsn1CatMemberInfo2Encode WVTAsn1CatMemberInfoDecode WVTAsn1CatMemberInfoEncode WVTAsn1CatNameValueDecode WVTAsn1CatNameValueEncode WVTAsn1IntentToSealAttributeDecode WVTAsn1IntentToSealAttributeEncode WVTAsn1SealingSignatureAttributeDecode WVTAsn1SealingSignatureAttributeEncode WVTAsn1SealingTimestampAttributeDecode WVTAsn1SealingTimestampAttributeEncode WVTAsn1SpcFinancialCriteriaInfoDecode WVTAsn1SpcFinancialCriteriaInfoEncode WVTAsn1SpcIndirectDataContentDecode WVTAsn1SpcIndirectDataContentEncode WVTAsn1SpcLinkDecode WVTAsn1SpcLinkEncode WVTAsn1SpcMinimalCriteriaInfoDecode WVTAsn1SpcMinimalCriteriaInfoEncode WVTAsn1SpcPeImageDataDecode WVTAsn1SpcPeImageDataEncode WVTAsn1SpcSigInfoDecode WVTAsn1SpcSigInfoEncode WVTAsn1SpcSpAgencyInfoDecode WVTAsn1SpcSpAgencyInfoEncode WVTAsn1SpcSpOpusInfoDecode WVTAsn1SpcSpOpusInfoEncode WVTAsn1SpcStatementTypeDecode WVTAsn1SpcStatementTypeEncode WinVerifyTrust WinVerifyTrustEx WintrustAddActionID WintrustAddDefaultForUsage WintrustCertificateTrust WintrustGetDefaultForUsage WintrustGetRegPolicyFlags WintrustLoadFunctionPointers WintrustRemoveActionID WintrustSetDefaultIncludePEPageHashes WintrustSetRegPolicyFlags WintrustUserWriteabilityCheck mscat32DllRegisterServer mscat32DllUnregisterServer mssip32DllRegisterServer mssip32DllUnregisterServer

Name

.text

Size

261KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wintrust.dll

PE Signature issue

msvcrt

api-ms-win-core-version-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-core-debug-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic