MdmDiagnosticsTool[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MdmDiagnosticsTool.exe
Size

16KB
MD5

e3d482b38e631b7234404407aab1f50b
SHA1

70c5d5a559f254fe27c7ebfb9b098aa0c18c8692
SHA256

dfabed97c02a84cbdf456a5eee7889163865aa982a5bca36497ef828c7669195
SHA512

2fb214450c908b340713d07dfa8f42f5c63051520a559018acb44f73469bd29263138428597a8d1409a9755179f7f04a381bd4034debd1e457298f280abf3d9c
SSDEEP

384:PHfrPloaosKmx6a2LXhJAfIi97cNGgWSi1W:PHfrm5lU6x4fIihcNGP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MdmDiagnosticsTool.exe

Files

MdmDiagnosticsTool.exe
.exe windows:10 windows x86

bd404e0684c46be64bec1817b63205f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_wcmdln
__set_app_type
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp
_except_handler4_common
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
memmove
??3@YAXPAX@Z
_lock
wprintf

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetStartupInfoW
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

mdmdiagnostics

ord1

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd404e0684c46be64bec1817b63205f1

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

mdmdiagnostics

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 936B

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 936B