MMDevAPI[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

MMDevAPI.dll
Size

344KB
MD5

dd8eac114e86965fcd82552f889ed23a
SHA1

bcbaa910970a6247821965ff04f60133684ca048
SHA256

a5e45576ab7efbe384002eb99630d77f2cbc42da6bf0bd6bc522f23069ec5b33
SHA512

8228a2ef731ea40befdf3035021979d3dcb7e05438e514223270083b66505c787715950e58804e8266dd1b364d046a60749462c7a9eb4ca0c509158afb321d27
SSDEEP

6144:CEjPZQ4t13mDSgiZhMYJdRppenoAd2c595erJmhi:CePZD3mW7ZhFJVpbAUs4rD

Score

1^/10

Malware Config

Signatures

Files

MMDevAPI.dll
.dll regsvr32 windows:10 windows x86 arch:x86

b860f30b4ba68540bd07e64aff1e4523

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-08-2015 17:15

Not After

18-11-2016 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:14:c5:ce:ec:ca:d0:2b:14:0d:45:b1:0f:03:a1:36:f4:9e:9a:ba:c3:2d:70:f6:cb:0a:74:aa:ee:6c:3a:c6
Signer

Actual PE Digest

78:14:c5:ce:ec:ca:d0:2b:14:0d:45:b1:0f:03:a1:36:f4:9e:9a:ba:c3:2d:70:f6:cb:0a:74:aa:ee:6c:3a:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MMDevAPI.pdb

Imports

msvcrt

_vsnwprintf
??1type_info@@UAE@XZ
realloc
_initterm
_amsg_exit
?terminate@@YAXXZ
_XcptFilter
_lock
_unlock
_onexit
memset
__CxxFrameHandler3
_vsnprintf
__dllonexit
_errno
_except_handler4_common
memcmp
_CxxThrowException
wcstol
_ftol2_sse
_wtoi
wcsncmp
_wcsicmp
wcstoul
memmove_s
calloc
wcscat_s
wcscpy_s
_resetstkoflw
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
memcpy

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
LoadStringW
GetModuleFileNameW
GetModuleHandleW
SizeofResource
FindResourceExW
LoadResource
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
AcquireSRWLockExclusive
DeleteCriticalSection
CreateEventW
ReleaseSRWLockShared
InitializeSRWLock
OpenSemaphoreW
SetEvent
WaitForSingleObjectEx
ReleaseSemaphore
CreateEventExW
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
ResetEvent
Sleep
ReleaseSRWLockExclusive
TryEnterCriticalSection
InitOnceExecuteOnce
CreateMutexExW
InitializeCriticalSection

api-ms-win-core-heap-l1-2-0

HeapDestroy
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-2

ProcessIdToSessionId
GetCurrentThreadId
OpenThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
CompareStringOrdinal

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale
FormatMessageW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

RpcBindingFromStringBindingW
NdrClientCall4
RpcStringFreeW
RpcStringBindingComposeW

ntdll

EtwSendNotification
EtwNotificationUnregister
EtwNotificationRegister
EtwLogTraceEvent
ShipAssert
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlQueryPackageClaims
EtwTraceMessage

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolWorkCallbacks
CreateThreadpoolIo
CreateThreadpoolTimer
CancelThreadpoolIo

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-io-l1-1-1

CancelSynchronousIo
DeviceIoControl
CancelIoEx
GetOverlappedResultEx

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount64
GetLocalTime
GetSystemTime
GetTickCount

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-service-private-l1-1-1

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-core-file-l1-2-1

CreateFileW
CompareFileTime

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

devobj

DevObjGetDeviceInterfacePropertyKeys
DevObjGetDeviceInterfaceAlias
DevObjGetDeviceInterfaceProperty
DevObjOpenDeviceInterfaceRegKey
DevObjSetDeviceProperty
DevObjGetDeviceProperty
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjOpenDeviceInterface
DevObjOpenDeviceInfo
DevObjGetDeviceInstanceId
DevObjEnumDeviceInfo
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList
DevObjSetDeviceInterfaceProperty

propsys

PropVariantToGUID

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ActivateAudioInterfaceAsync
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 32B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b860f30b4ba68540bd07e64aff1e4523

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

78:14:c5:ce:ec:ca:d0:2b:14:0d:45:b1:0f:03:a1:36:f4:9e:9a:ba:c3:2d:70:f6:cb:0a:74:aa:ee:6c:3a:c6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

rpcrt4

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-localization-private-l1-1-0

api-ms-win-core-profile-l1-1-0

devobj

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 298KB - Virtual size: 298KB

RT_BSS Size: - Virtual size: 32B

.data Size: 2KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 212B

RT_DATA Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

78:14:c5:ce:ec:ca:d0:2b:14:0d:45:b1:0f:03:a1:36:f4:9e:9a:ba:c3:2d:70:f6:cb:0a:74:aa:ee:6c:3a:c6
Signer

.text
Size: 298KB - Virtual size: 298KB

RT_BSS
Size: - Virtual size: 32B

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 212B

RT_DATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB