WinSCard.dll

  • File Path: C:\Windows\SysWOW64\WinSCard.dll
  • Description: Microsoft Smart Card API

Hashes

Type Hash
MD5 6A489CEF8DE0F8547F0D993B97D26EB5
SHA1 F7E7B42DB08C11EA130BF8F467AE322D2B0E7E22
SHA256 AAC2EDB8E6A4725446E7FFD4EE63F3DC8844795C6FA8F0EF8AADF2BD581704CD
SHA384 3F06150EA7FD41A7857D7A58E2779D26F73A9A2765B5A881422E1DDE60DA00BF2ECC54BA25FCB44BDF3F90CE0F1033CC
SHA512 B0BD541AD7E4714A45AFBC4F48C5416213353295609858E95F50F35656E8F86D03757463B65AC8C28D1F0B00AA36536D73EF2AC4D2375A24487DC8FE431E2193
SSDEEP 3072:2JdrNi4Gevasi3u1CldQ0IqaMd9em9eeDb9L:ErN2eji3u1CIw9dMm9eeH9L
IMP 724C2382B81790A2B7A511DA18B137C7
PESHA1 5A65B512577052FB1F0019B96F83199866326226
PE256 434B200BAABD72F2269C292E253F8CDF71720C90D7BA091A7212BA2D2AAA8F8D

DLL Exports:

Function Name Ordinal Type
SCardListReadersWithDeviceInstanceIdA 56 Exported Function
SCardListReadersWithDeviceInstanceIdW 57 Exported Function
SCardListReadersW 55 Exported Function
SCardListReaderGroupsW 53 Exported Function
SCardListReadersA 54 Exported Function
SCardLocateCardsW 61 Exported Function
SCardPciRaw 3 Exported Function
SCardLocateCardsByATRW 60 Exported Function
SCardLocateCardsA 58 Exported Function
SCardLocateCardsByATRA 59 Exported Function
SCardIntroduceReaderW 46 Exported Function
SCardIsValidContext 47 Exported Function
SCardIntroduceReaderGroupW 45 Exported Function
SCardIntroduceReaderA 43 Exported Function
SCardIntroduceReaderGroupA 44 Exported Function
SCardListInterfacesW 51 Exported Function
SCardListReaderGroupsA 52 Exported Function
SCardListInterfacesA 50 Exported Function
SCardListCardsA 48 Exported Function
SCardListCardsW 49 Exported Function
SCardSetCardTypeProviderNameW 71 Exported Function
SCardState 72 Exported Function
SCardSetCardTypeProviderNameA 70 Exported Function
SCardRemoveReaderFromGroupW 68 Exported Function
SCardSetAttrib 69 Exported Function
SCardWriteCacheA 76 Exported Function
SCardWriteCacheW 77 Exported Function
SCardTransmit 75 Exported Function
SCardStatusA 73 Exported Function
SCardStatusW 74 Exported Function
SCardReadCacheW 63 Exported Function
SCardReconnect 64 Exported Function
SCardReadCacheA 62 Exported Function
SCardPciT0 4 Exported Function
SCardPciT1 5 Exported Function
SCardReleaseStartedEvent 66 Exported Function
SCardRemoveReaderFromGroupA 67 Exported Function
SCardReleaseNewReaderEvent 7 Exported Function
SCardReleaseAllEvents 6 Exported Function
SCardReleaseContext 65 Exported Function
SCardControl 16 Exported Function
SCardDisconnect 17 Exported Function
SCardConnectW 15 Exported Function
SCardCancel 13 Exported Function
SCardConnectA 14 Exported Function
SCardForgetCardTypeW 21 Exported Function
SCardForgetReaderA 22 Exported Function
SCardForgetCardTypeA 20 Exported Function
SCardEndTransaction 18 Exported Function
SCardEstablishContext 19 Exported Function
g_rgSCardT1Pci 80 Exported Function
SCardAccessNewReaderEvent 2 Exported Function
g_rgSCardT0Pci 79 Exported Function
ClassInstall32 1 Exported Function
g_rgSCardRawPci 78 Exported Function
SCardAudit 11 Exported Function
SCardBeginTransaction 12 Exported Function
SCardAddReaderToGroupW 10 Exported Function
SCardAccessStartedEvent 8 Exported Function
SCardAddReaderToGroupA 9 Exported Function
SCardGetReaderIconA 36 Exported Function
SCardGetReaderIconW 37 Exported Function
SCardGetReaderDeviceInstanceIdW 35 Exported Function
SCardGetProviderIdW 33 Exported Function
SCardGetReaderDeviceInstanceIdA 34 Exported Function
SCardIntroduceCardTypeA 41 Exported Function
SCardIntroduceCardTypeW 42 Exported Function
SCardGetTransmitCount 40 Exported Function
SCardGetStatusChangeA 38 Exported Function
SCardGetStatusChangeW 39 Exported Function
SCardFreeMemory 26 Exported Function
SCardGetAttrib 27 Exported Function
SCardForgetReaderW 25 Exported Function
SCardForgetReaderGroupA 23 Exported Function
SCardForgetReaderGroupW 24 Exported Function
SCardGetDeviceTypeIdW 31 Exported Function
SCardGetProviderIdA 32 Exported Function
SCardGetDeviceTypeIdA 30 Exported Function
SCardGetCardTypeProviderNameA 28 Exported Function
SCardGetCardTypeProviderNameW 29 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: winscard.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/aac2edb8e6a4725446e7ffd4ee63f3dc8844795c6fa8f0ef8aadf2bd581704cd/detection/

Possible Misuse

The following table contains possible examples of WinSCard.dll being misused. While WinSCard.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_susp_image_load.yml description: Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz DRL 1.0
sigma sysmon_susp_image_load.yml - '*\WinSCard.dll' DRL 1.0
malware-ioc rtm WinSCard.dll © ESET 2014-2018
signature-base crime_shifu_trojan.yar $s5 = “WinSCard.dll” fullword ascii /* Goodware String - occured 83 times */ CC BY-NC 4.0

MIT License. Copyright (c) 2020 Strontic.