cmutil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cmutil.dll
Resource
win10v2004-20240426-en
General
-
Target
cmutil.dll
-
Size
44KB
-
MD5
9cfc5c7e355d292dbecc269f50dcae24
-
SHA1
f2da685c314a9cc07e0058514face8ac0edeeaac
-
SHA256
e16093f0d634a36c04a5bcebb4faf8ef4703c4059f58e51f4177adebc7dd1584
-
SHA512
c65eaa532b12cb8b94e406e4bf5683f1c67b63768e8186799f4fa3f09e83476fa4849db5f053573c231976ea5befb67a02da7d9331d01232d8692c2919fadc55
-
SSDEEP
768:UDGClK8IMVD+oDbma9sqt5XVs/4YUSrBK1U4umg+kiNIPjJDCf91a:U1lK8IMVKcbma9sgrYuQYU4jg+kiNIPl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cmutil.dll
Files
-
cmutil.dll.dll windows:10 windows x86 arch:x86
07edf7788b7811fee77a38102ce915ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_XcptFilter
_amsg_exit
free
malloc
_initterm
_except_handler4_common
_vsnwprintf
_vsnprintf
memset
advapi32
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyExA
RegDeleteValueW
gdi32
CreateFontIndirectW
DeleteObject
GetObjectA
kernel32
TlsGetValue
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetVersionExW
GetTickCount
lstrlenA
GetLastError
CreateFileA
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringW
lstrlenW
GetPrivateProfileIntW
CreateFileW
GetPrivateProfileStringW
CreateDirectoryW
HeapFree
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
SetEndOfFile
GetTempPathW
GetFileAttributesW
IsDBCSLeadByte
GetSystemDirectoryW
HeapAlloc
GetFileSize
GetProcessHeap
WideCharToMultiByte
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetCurrentProcess
GetProcAddress
GetTimeFormatW
FreeLibrary
GetDateFormatW
LoadLibraryExW
DisableThreadLibraryCalls
TlsAlloc
TlsFree
HeapReAlloc
CompareStringW
TlsSetValue
SetLastError
GetStringTypeExW
MultiByteToWideChar
CompareStringA
GetStringTypeExA
user32
SendMessageW
LoadImageW
GetSystemMetrics
CharPrevW
CharNextA
CharUpperW
LoadStringA
LoadStringW
LoadImageA
CharNextW
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Exports
Exports
??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
??0CRandom@@QAE@I@Z
??0CRandom@@QAE@XZ
??0CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
??4CIniW@@QAEAAV0@ABV0@@Z
??4CRandom@@QAEAAV0@$$QAV0@@Z
??4CRandom@@QAEAAV0@ABV0@@Z
??4CmLogFile@@QAEAAV0@ABV0@@Z
??_FCIniA@@QAEXXZ
??_FCIniW@@QAEXXZ
?Banner@CmLogFile@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IBEHPAUHKEY__@@PBD1PBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IBEHPAUHKEY__@@PBG1PBEKK@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?Clear@CIniA@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?Clear@CmLogFile@@QAEXH@Z
?CloseFile@CmLogFile@@AAEJXZ
?DeInit@CmLogFile@@QAEJXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?GPPB@CIniA@@QBEHPBD0H@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GPPI@CIniA@@QBEKPBD0K@Z
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?Generate@CRandom@@QAEHXZ
?GetFile@CIniA@@QBEPBDXZ
?GetFile@CIniW@@QBEPBGXZ
?GetHInst@CIniA@@QBEPAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?GetPrimaryFile@CIniA@@QBEPBDXZ
?GetPrimaryFile@CIniW@@QBEPBGXZ
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GetRegPath@CIniA@@QBEPBDXZ
?GetRegPath@CIniW@@QBEPBGXZ
?GetSection@CIniA@@QBEPBDXZ
?GetSection@CIniW@@QBEPBGXZ
?Init@CRandom@@QAEXK@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?IsEnabled@CmLogFile@@QAEHXZ
?LoadEntry@CIniA@@IBEPADPBD@Z
?LoadEntry@CIniW@@IBEPAGPBG@Z
?LoadSection@CIniA@@QBEPADPBD@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AAEJXZ
?SetEntry@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniA@@QAEXK@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
?SetFile@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniA@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetRegPath@CIniA@@QAEXPBD@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniA@@QAEXPBD@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetWriteICSData@CIniA@@QAEXH@Z
?SetWriteICSData@CIniW@@QAEXH@Z
?Start@CmLogFile@@QAEJH@Z
?Stop@CmLogFile@@QAEJXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniA@@QAEXPBD0K@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniA@@QAEXPBD00@Z
?WPPS@CIniW@@QAEXPBG00@Z
?Write@CmLogFile@@AAEJPAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmMoveMemory
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ