MDEServer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MDEServer.exe
Size

447KB
MD5

0554b3f5c574107d18816ac051426680
SHA1

d714ee30097bd9e6996943dce0dd625b26ac35e7
SHA256

7ce47e4ecfdb5db0ad6653ec19aff31d15abea7dfcceae8a5b61370ef60408da
SHA512

052b8b01d17a1f600c0e5a886fc84af81c3096d21c8f0acd2eee80c965f52febd8373326ea43e95de4801ce6863c4037dbbda2f8d496ad237bf94fe11163aaf9
SSDEEP

6144:nz08tV5why7gd/Ad2n6+enioLsqXT71LpIZXU7u0+BpVdpsMGss6:nz3kFAd4eniSsET71krBpVd6MGW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MDEServer.exe

Files

MDEServer.exe
.exe windows x64

b5c649687d38753a958f69230a1e5c34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_i64tow_s
wcsncmp
_vsnwprintf
__C_specific_handler
memmove_s
malloc
_ultow_s
_callnewh
sqrtf
towupper
?terminate@@YAXXZ
realloc
_wcsnicmp
_wsplitpath_s
memset
memmove
memcpy
swscanf_s
_wcsicmp
towlower
iswxdigit
wcsrchr
_wcslwr_s
wcstol
_ui64tow_s
wcstoul
_wcstoui64
_ltow_s
qsort
strncpy_s
strnlen
wcschr
_errno
_onexit
__dllonexit
_unlock
_lock
_commode
iswdigit
_fmode
iswalpha
_wcmdln
_initterm
__setusermatherr
memcpy_s
wcsncpy_s
wcsstr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
wcscat_s
wcscpy_s
_purecall
_amsg_exit
_XcptFilter
calloc
free
ceil
floor
logf
memcmp
wcscmp

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
HeapDestroy
HeapSize
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
GetProcAddress
GetModuleHandleExW
FreeLibrary
SizeofResource
LoadLibraryExW
GetModuleFileNameW
FindResourceExW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ReleaseSRWLockExclusive
CreateWaitableTimerExW
WaitForSingleObject
SetEvent
InitializeCriticalSection
SetWaitableTimer
DeleteCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
CreateEventW

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TerminateProcess
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetStartupInfoW
GetCurrentProcess
TlsGetValue

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW
CharUpperBuffW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeExW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerSetRequest
PowerClearRequest

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathIsRelativeW
PathCombineW
PathIsFileSpecW

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileSize

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringA

winmde

MFCreateWinMDEOpCenter
MFCreateNetVRoot

api-ms-win-core-localization-l1-2-0

IsValidLocaleName

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c649687d38753a958f69230a1e5c34

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

winmde

api-ms-win-core-localization-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 368KB - Virtual size: 368KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 9KB - Virtual size: 8KB

.didat Size: 1024B - Virtual size: 728B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 368KB - Virtual size: 368KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 9KB - Virtual size: 8KB

.didat
Size: 1024B - Virtual size: 728B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB