dmcertinst[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dmcertinst.exe
Size

200KB
MD5

86f757ed1c585efb91a914161eb54435
SHA1

5e922c071f374de7f42047ba42b28fec9816ddcb
SHA256

b5b8818c1403f1fea8369c98f4012bfddb92bd8bc23eca31dcadb704a08336cb
SHA512

5afb5c0fb4cbe8a1dc01f83439ea5e4ebaed04b14c1fd24947697d7448c2decead74c09d6bc6e10c6bff13d66cf5c92646554e6ccc728b5367611e884f4d9847
SSDEEP

3072:RULpcH35sf/Ewq+9m01TH39H6RWbJz/FKzHexMa+KeJa/:R4yH35sk+mM39ZgaxjeJa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dmcertinst.exe

Files

dmcertinst.exe
.exe windows:10 windows x64 arch:x64

6fa111be22ebcbcba674021f10d664c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp110_win

??0?$codecvt@GDH@std@@QEAA@_K@Z
??1?$codecvt@GDH@std@@MEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$codecvt@GDH@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$codecvt@GDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?in@?$codecvt@GDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAG3AEAPEAG@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPEBDH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Container_base12@std@@QEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ

msvcrt

memmove
memcpy
memcmp
_CxxThrowException
memset
_fmode
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_wcsnicmp
memmove_s
sprintf_s
__CxxFrameHandler4
_vsnprintf
swprintf_s
wcstoul
wcstok_s
_vsnwprintf
memcpy_s
??3@YAXPEAX@Z
_purecall
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
??0exception@@QEAA@XZ
_unlock
_lock
_commode
wcscmp
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
free
malloc
??0exception@@QEAA@AEBV0@@Z
_wcsicmp
wcsstr
wcsrchr
??_V@YAXPEAX@Z
wcscpy_s
_vsnprintf_s

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetStartupInfoW
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
AcquireSRWLockShared
DeleteCriticalSection
WaitForMultipleObjectsEx
OpenEventW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSRWLockShared
SetEvent
CreateEventExW
ReleaseSRWLockExclusive
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegDeleteTreeW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyExW
RegQueryInfoKeyW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoGetApartmentType
CreateStreamOnHGlobal
CoUninitialize
GetHGlobalFromStream
CoInitializeEx
CoCreateInstance

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemTime

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock

ntdll

RtlIsStateSeparationEnabled

omadmapi

ord64
ord35

certenroll

ord45

umpdc

Pdcv2ActivationClientActivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientDeactivate

declaredconfiguration

DMOrchestratorUpdateDocStatus

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString
SysStringLen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

ncrypt

NCryptDeleteKey
NCryptOpenKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenStorageProvider

crypt32

CryptSetKeyIdentifierProperty
CertFreeCertificateContext
CryptUnprotectData
CertFindCertificateInStore
CertDeleteCertificateFromStore
CertGetCertificateContextProperty
CryptBinaryToStringW
CryptEncodeObjectEx
CertOpenStore
CertCloseStore

rpcrt4

UuidCreate

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

dmcmnutils

UnicodeToMB
HexStringToBinary
BinaryToHexString
CopyString
OmaDmRegistryGetDWORD

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fa111be22ebcbcba674021f10d664c9

Headers

DLL Characteristics

File Characteristics

Imports

msvcp110_win

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

ntdll

omadmapi

certenroll

umpdc

declaredconfiguration

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

ncrypt

crypt32

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

dmcmnutils

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 124KB - Virtual size: 122KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 8KB - Virtual size: 6KB

.didat Size: 4KB - Virtual size: 160B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 556B

.text
Size: 124KB - Virtual size: 122KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 8KB - Virtual size: 6KB

.didat
Size: 4KB - Virtual size: 160B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 556B