MDEServer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MDEServer.exe
Size

347KB
MD5

ce248bf5dbcce552367f2593b4d8433e
SHA1

bca9e0f949b4fe0005c0c8d906ca13821d599f29
SHA256

c642324f9de9d00de71098d076cb5c285d92bb997f5912054bb875d630c3c23f
SHA512

cd3a05c724cbbbbc19e17a0100e3eb02f5b7115a9685c4d57442d8e3ac1fb055881e0a763e002fea6a411f436b166716984b79c154363d9a609766c0875213ce
SSDEEP

6144:IMo+DybWmEHytF/79u+hPrnQUm3969/xDyHqErCwxwlxoKg5D:IWkWmEHyVu+hjnQUTCKErCwWl/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MDEServer.exe

Files

MDEServer.exe
.exe windows:10 windows x86

980e17d88097786081ad6c0962b2de5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_unlock
__dllonexit
__p__commode
_XcptFilter
_onexit
calloc
__setusermatherr
_errno
realloc
memset
_callnewh
_lock
malloc
?terminate@@YAXXZ
_i64tow_s
memmove_s
_controlfp
_except_handler4_common
_wcmdln
wcsstr
towupper
iswalpha
iswdigit
memcmp
floor
ceil
_wcsicmp
swscanf_s
towlower
iswxdigit
wcsrchr
_wcslwr_s
wcstol
_ui64tow_s
wcstoul
_wcstoui64
_ltow_s
_vsnwprintf
wcsncmp
free
_wcsnicmp
_ultow_s
memmove
_wsplitpath_s
wcschr
memcpy_s
wcsncpy_s
wcscat_s
wcscpy_s
_purecall
_initterm
_CIlog
_CIsqrt
_ftol2
memcpy

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapSize
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
GetProcAddress
LockResource
LoadResource
FindResourceExW
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

SetEvent
WaitForSingleObject
Sleep
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetWaitableTimer
CreateEventW
CreateWaitableTimerExW
LeaveCriticalSection

api-ms-win-core-processthreads-l1-1-2

CreateThread
TerminateProcess
GetCurrentProcess
TlsGetValue
TlsSetValue
GetStartupInfoW
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l2-1-0

CharUpperBuffW
CharNextW
CharUpperW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventRegister

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
GetStringTypeExW
MultiByteToWideChar
CompareStringW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerClearRequest
PowerSetRequest
PowerCreateRequest

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsFileSpecW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeW

api-ms-win-core-file-l1-2-1

CreateFileW
GetFileSize

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringA
IsDebuggerPresent

winmde

MFCreateWinMDEOpCenter
MFCreateNetVRoot

api-ms-win-core-localization-l1-2-1

IsValidLocaleName

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Sections

.text
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

980e17d88097786081ad6c0962b2de5f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

winmde

api-ms-win-core-localization-l1-2-1

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 312KB - Virtual size: 311KB

.data Size: 4KB - Virtual size: 7KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 352B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 312KB - Virtual size: 311KB

.data
Size: 4KB - Virtual size: 7KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 352B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB