dmclient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dmclient.exe
Size

117KB
MD5

2210fe3b3e1b85a401749facef6e4958
SHA1

914f9a5dadec0b5ce5774e3d0826e5c01a040aa8
SHA256

c41258fa588b650483dee87057aa82f7b855eb257d3d25be41f71e90c8ca9746
SHA512

7976b0ec84b6526de1047c9b0a0e3336e01e0e24156435f1f12a7fe2860bebbf1cd469f8e13ccf2f0310ec0a0744a5f7e79751bc1c2b82bd9d999039a51a5b06
SSDEEP

3072:Bcl5/6zyEaXis8D0IILS29eQKYbSG9XST9h+qJSp6jTsj:Bcl5/6zkXisy0IUS29eQKhUXST3tzjo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dmclient.exe

Files

dmclient.exe
.exe windows x64

3f53cad1bac93ee5ac20ea3e53fe8cd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_lock
__C_specific_handler
_initterm
_amsg_exit
??1type_info@@UEAA@XZ
__setusermatherr
_XcptFilter
__wgetmainargs
_cexit
_unlock
?terminate@@YAXXZ
memcpy
_commode
_CxxThrowException
__set_app_type
?what@exception@@UEBAPEBDXZ
_exit
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
_onexit
??0exception@@QEAA@XZ
memmove
??1exception@@UEAA@XZ
__CxxFrameHandler3
_purecall
__dllonexit
wcsnlen
_wtoi64
wcstod
vswprintf_s
_vscwprintf
toupper
??3@YAXPEAX@Z
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
exit
memcmp
_fmode
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegCloseKey

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
CreateMutexExW
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
CreateEventExW
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoWaitForMultipleHandles

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventProviderEnabled
EventSetInformation
EventWriteTransfer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserPreferredUILanguages

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
FindNextFileW
GetFileSize
DeleteFileW
CreateDirectoryW
FindFirstFileW
FindClose

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

crypt32

CryptStringToBinaryW

ntdll

NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

xmllite

CreateXmlReader

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW
GetPersistedFileLocationW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f53cad1bac93ee5ac20ea3e53fe8cd2

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

crypt32

ntdll

api-ms-win-core-registry-l2-1-0

api-ms-win-shcore-stream-l1-1-0

xmllite

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 71KB - Virtual size: 71KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 200B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 792B

.text
Size: 71KB - Virtual size: 71KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 792B