dmcertinst[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dmcertinst.exe
Size

192KB
MD5

f1574cf4523b2335746d33cbca9fe34d
SHA1

6bead80749d1ae6d61d5ae60ff410d2a60363898
SHA256

7a216017eaddb3aaf3403eb29f8fbae92ca16a48e041709d3d13f7db71043d15
SHA512

7fd33cf3cb5d54834cee07c6ed2ac20151ea19dd3456fc8934eb512e36c297a01cc3ffeb98424270d28e728af3081bff01495da16a03801b6073c5c5d7dfa207
SSDEEP

3072:E6Otl03V70tHvbMlyI+MAflyu/0arjZqR/Qfq7x43PPw9K:EBtl03VYxb19TflyusarQCH33w9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dmcertinst.exe

Files

dmcertinst.exe
.exe windows x64

bdddc53b2e9637a907d10d078bcd7eac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp110_win

??1?$codecvt@GDH@std@@MEAA@XZ
??1_Container_base12@std@@QEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Lockit@std@@QEAA@XZ
??_7facet@locale@std@@6B@
?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QEAA@H@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?in@?$codecvt@GDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAG3AEAPEAG@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Getcat@?$codecvt@GDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@GDH@std@@2V0locale@2@A
?_Orphan_all@_Container_base12@std@@QEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Syserror_map@std@@YAPEBDH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xlength_error@std@@YAXPEBD@Z
??_7codecvt_base@std@@6B@
??_7?$codecvt@GDH@std@@6B@
?_Winerror_map@std@@YAPEBDH@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
??0?$codecvt@GDH@std@@QEAA@_K@Z
??_7_Facet_base@std@@6B@

msvcrt

memmove
memcpy
memcmp
_CxxThrowException
memset
_wcmdln
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_wcsnicmp
strrchr
strchr
strtol
_errno
_set_errno
strncpy_s
sprintf_s
__CxxFrameHandler3
_vsnprintf
swprintf_s
wcstoul
memmove_s
wcstok_s
_vsnwprintf
memcpy_s
??3@YAXPEAX@Z
_purecall
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
??0exception@@QEAA@XZ
_lock
_commode
_fmode
wcscmp
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
free
malloc
??0exception@@QEAA@AEBV0@@Z
_wcsicmp
wcsstr
wcsrchr
??_V@YAXPEAX@Z
wcscpy_s
_vsnprintf_s

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
LoadStringW
GetModuleFileNameW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
GetCurrentProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
CreateEventExW
SetEvent
WaitForMultipleObjectsEx
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
ReleaseSRWLockShared
OpenEventW
CreateMutexExW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
AcquireSRWLockShared
OpenSemaphoreW
AcquireSRWLockExclusive

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile

api-ms-win-core-com-l1-1-0

GetHGlobalFromStream
CoWaitForMultipleHandles
CoGetApartmentType
CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoUninitialize

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock

ntdll

RtlIsStateSeparationEnabled

omadmapi

ord64
ord35

certenroll

ord45

umpdc

Pdcv2ActivationClientRegister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientRenewActivation

declaredconfiguration

DMOrchestratorUpdateDocStatus

oleaut32

SysFreeString
VariantInit
SysStringLen
SysAllocString
VariantClear

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

ncrypt

NCryptDeleteKey
NCryptOpenKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenStorageProvider

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CryptSetKeyIdentifierProperty
CertFindCertificateInStore
CryptBinaryToStringW
CryptEncodeObjectEx
CertOpenStore
CertDeleteCertificateFromStore
CertCloseStore
CryptUnprotectData

rpcrt4

UuidCreate

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

dmcmnutils

UnicodeToMB
HexStringToBinary
BinaryToHexString
CopyString
OmaDmRegistryGetDWORD

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdddc53b2e9637a907d10d078bcd7eac

Headers

DLL Characteristics

File Characteristics

Imports

msvcp110_win

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

ntdll

omadmapi

certenroll

umpdc

declaredconfiguration

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ncrypt

crypt32

rpcrt4

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

dmcmnutils

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 127KB - Virtual size: 126KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 176B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 540B

.text
Size: 127KB - Virtual size: 126KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 176B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 540B