dmclient[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

dmclient.exe
Size

148KB
MD5

83f869fe590e3cec72a262633046daa7
SHA1

11f9f5c56ada7bf3f5df3ed314e49ef6b62bb12f
SHA256

a86386e31099e29b74a1d0463f7f83c1237e11cf96764a9f2bfe313b46c1a02f
SHA512

d5988bf22cfd74760c8f0cace277704785e340c8355a8e8a81cbb598a710eed0c693191479703a522173d994c0125e0a2f7dfafd28349d560a102bae15aed050
SSDEEP

3072:xbpyc4tzPX8tPSBzciBonRzL+Cfe800hm8P21tSxuv:xbYc4p8tPSBzRWnBmp1tw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dmclient.exe

Files

dmclient.exe
.exe windows:10 windows x64 arch:x64

7ddacfe1546d64f4283246f9a84c2430

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_unlock
memcmp
_exit
_cexit
__setusermatherr
_lock
memmove
memcpy
__set_app_type
_initterm
__wgetmainargs
malloc
_vsnprintf_s
?terminate@@YAXXZ
_commode
?what@exception@@UEBAPEBDXZ
_callnewh
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler4
__dllonexit
_CxxThrowException
_onexit
??0exception@@QEAA@XZ
__C_specific_handler
_amsg_exit
_XcptFilter
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBD@Z
_purecall
wcsnlen
_wtoi64
wcstod
vswprintf_s
_vscwprintf
??3@YAXPEAX@Z
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
_fmode
exit
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExA
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObject
SetEvent
CreateEventExW
CreateMutexExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
CoWaitForMultipleHandles

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoInitialize
RoGetActivationFactory
RoUninitialize

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenThreadToken
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetUserPreferredUILanguages
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-file-l1-1-0

WriteFile
GetFileSize
FindNextFileW
FindClose
DeleteFileW
CreateDirectoryW
ReadFile
FindFirstFileW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-security-base-l1-1-0

GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

crypt32

CryptStringToBinaryW

ntdll

NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

xmllite

CreateXmlReader

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedFileLocationW
GetPersistedRegistryLocationW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ddacfe1546d64f4283246f9a84c2430

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

crypt32

ntdll

api-ms-win-core-registry-l2-1-0

api-ms-win-shcore-stream-l1-1-0

xmllite

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 84KB - Virtual size: 80KB

.rdata Size: 40KB - Virtual size: 37KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 2KB

.didat Size: 4KB - Virtual size: 200B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 804B

.text
Size: 84KB - Virtual size: 80KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 2KB

.didat
Size: 4KB - Virtual size: 200B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 804B