General

Malware Config

Signatures

Files

• 287517810a3fd525c1ce1a5e3e9ebbcc86f2f4a13451e792f9acd4e635da7492

  .dll windows:6 windows x64 arch:x64

  8ea079a6c15d6e3a8445e3e6f878c8eb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetCurrentThread

  FreeLibrary

  Sleep

  RtlCaptureContext

  CloseHandle

  VirtualProtect

  MapViewOfFile

  CreateFileMappingW

  CreateFileA

  K32GetModuleInformation

  GetModuleHandleA

  QueueUserAPC

  GetCurrentProcess

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  IsDebuggerPresent

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  RtlLookupFunctionEntry

  advapi32

  CryptDestroyHash

  CryptReleaseContext

  CryptDecrypt

  CryptDeriveKey

  CryptHashData

  CryptCreateHash

  CryptAcquireContextW

  CryptDestroyKey

  vcruntime140

  __std_type_info_destroy_list

  __C_specific_handler

  memset

  memcpy

  api-ms-win-crt-runtime-l1-1-0

  _cexit

  _execute_onexit_table

  _initterm

  _initialize_narrow_environment

  _configure_narrow_argv

  _seh_filter_dll

  _initterm_e

  _initialize_onexit_table

  Exports

  Exports

  MpAddDynamicSignatureFile

  MpAllocMemory

  MpAmsiCloseSession

  MpAmsiScan

  MpCleanControl

  MpCleanOpen

  MpCleanPrecheckStart

  MpCleanStart

  MpClientUtilExportFunctions

  MpClose

  MpConfigClose

  MpConfigDelValue

  MpConfigGetValue

  MpConfigGetValueAlloc

  MpConfigInitialize

  MpConfigIteratorClose

  MpConfigIteratorEnum

  MpConfigIteratorOpen

  MpConfigOpen

  MpConfigRegisterForNotifications

  MpConfigSetValue

  MpConfigUninitialize

  MpConfigUnregisterNotifications

  MpConveyDlpBypass

  MpConveySampleSubmissionResult

  MpConveyUserChoiceForSampleList

  MpCreateComInstance

  MpDbgAllocMemory

  MpDebugExportFunctions

  MpDeleteAsrHistory

  MpDetectionEnumerate

  MpDetectionQuery

  MpDynamicSignatureEnumerate

  MpDynamicSignatureOpen

  MpElevateCleanHandle

  MpElevationHandleAcquire

  MpElevationHandleActivate

  MpElevationHandleAttach

  MpElevationHandleOpen

  MpErrorMessageFormat

  MpFastMemoryScan

  MpFastMemoryScanOpen

  MpFlushLowfiCache

  MpForcedReboot

  MpFreeMemory

  MpGenerateSignature

  MpGenerateSignatureEx

  MpGenerateThreatReport

  MpGetAsrBlockedActionInfos

  MpGetAsrBlockedActions

  MpGetAsrBlockedProcesses

  MpGetCallistoDetections

  MpGetDevMode

  MpGetEngineVersion

  MpGetHIPSRuleInfo

  MpGetMAPSConnectivityStatusInfo

  MpGetRunningMode

  MpGetSampleChunk

  MpGetSampleListRequiringConsent

  MpGetTPStateInfo

  MpGetTaskSchedulerStrings

  MpHandleClose

  MpIsGivenRunningModeSupported

  MpIsRtpAutoEnable

  MpManagerDisable

  MpManagerEnable

  MpManagerOpen

  MpManagerStatusQuery

  MpManagerStatusQueryEx

  MpManagerVersionQuery

  MpManagerXBGMDisable

  MpManagerXBGMEnable

  MpMemoryScanStart

  MpNetworkCapture

  MpNotificationRegister

  MpOfflineScanInstall

  MpOfflineScanStatusQuery

  MpOpen

  MpProductGenuineCheck

  MpQuarantineRequest

  MpQueryDefaultFolderGuardList

  MpQueryEngineConfigDword

  MpQueryFileTrustByHandle

  MpRemapCallistoDetections

  MpRemoveDynamicSignatureFile

  MpRequestSnooze

  MpSampleQuery

  MpSampleSubmit

  MpScanControl

  MpScanResult

  MpScanStart

  MpScanStartEx

  MpSetBreakTheGlassStatus

  MpSetTPState

  MpSetUacElevationDefaultWindowHandle

  MpSmartLockerEnable

  MpTelemetryAddToAverageDWORD

  MpTelemetryAddToStreamDWORD

  MpTelemetryAddToStreamDWORD64

  MpTelemetryAddToStreamString

  MpTelemetryIncrementDWORD

  MpTelemetryInitialize

  MpTelemetryIsOptIn

  MpTelemetryLiteralAddToAverageDWORD

  MpTelemetryLiteralAddToStreamDWORD

  MpTelemetryLiteralAddToStreamDWORD64

  MpTelemetryLiteralAddToStreamString

  MpTelemetryLiteralIncrementDWORD

  MpTelemetryLiteralSetDWORD

  MpTelemetryLiteralSetDWORD64

  MpTelemetryLiteralSetIfMaxDWORD

  MpTelemetryLiteralSetIfMinDWORD

  MpTelemetryLiteralSetString

  MpTelemetrySetConsent

  MpTelemetrySetDWORD

  MpTelemetrySetDWORD64

  MpTelemetrySetIfMaxDWORD

  MpTelemetrySetIfMinDWORD

  MpTelemetrySetString

  MpTelemetryUninitialize

  MpTelemetryUpdateUserConsent

  MpTelemetryUpload

  MpThreatEnumerate

  MpThreatHistoryRequest

  MpThreatLocalizedInfoQuery

  MpThreatOpen

  MpThreatQuery

  MpThreatRollup

  MpTriggerErrorHeartbeatReport

  MpTriggerHeartbeatOnUninstall

  MpTriggerStatusRefreshNotification

  MpUpdateControl

  MpUpdateDevMode

  MpUpdateEngine

  MpUpdatePlatform

  MpUpdateStart

  MpUpdateStartEx

  MpUtilsExportFunctions

  MpWDEnable

  MpXBGMEnable

  MpXBGMFreeEvent

  MpXBGMGetData

  MpXBGMPutData

  MpXBGMUpdateIV

  MputAddToAverageDWORD64Rpc

  MputAddToAverageDWORDRpc

  MputIncrementDWORD64Rpc

  MputIncrementDWORDRpc

  MputSetBoolRpc

  MputSetDWORD64Rpc

  MputSetDWORDRpc

  MputSetIfMaxDWORD64Rpc

  MputSetIfMaxDWORDRpc

  MputSetIfMinDWORD64Rpc

  MputSetIfMinDWORDRpc

  MputSetStringRpc

  WDEnable

  WDStatus

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 271KB - Virtual size: 272KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 492B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 44B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ