DolbyDecMFT[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DolbyDecMFT.dll
Size

939KB
MD5

b26b5da756f1b763bf2c984d6fe1cd23
SHA1

85e899e693933c60af396cede68d5c83edcdcbcc
SHA256

2b9dbda38d40a6929bcd28c60a2b7d699e3c4fa8c99e4a49de982911379c743b
SHA512

9ed1493736afa4ffe777d263210a39c288eeca4ae5309f159f0fc202bc3bcb41545d06b814879db7d8bd9cb9480f722eba274fc8f874705537f7a3d67f33a313
SSDEEP

24576:iwr+XzxOyaFHYrbKdoP5rtwStBl5gukhv1E2JYYsoMAk:9+xOyIHYrbKdoP5rtptNywGs/Ak

Score

1^/10

Malware Config

Signatures

Files

DolbyDecMFT.dll
.dll regsvr32 windows:10 windows x86 arch:x86

474e269553446b80890c39090dd49645

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:48:9c:50:45:d8:be:4d:4a:5d:e6:b7:d6:f8:61:c9:9e:87:8c:41:61:46:cd:98:cb:3e:06:46:6d:cf:59:86
Signer

Actual PE Digest

a7:48:9c:50:45:d8:be:4d:4a:5d:e6:b7:d6:f8:61:c9:9e:87:8c:41:61:46:cd:98:cb:3e:06:46:6d:cf:59:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DolbyAtmosDecMFT.pdb

Imports

msvcrt

??0exception@@QAE@ABQBD@Z
strncpy_s
memcpy
strnlen
_ftol2_sse
wcsnlen
time
rand
?what@exception@@UBEPBDXZ
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memmove
_vsnprintf
memcpy_s
_vsnwprintf
??0exception@@QAE@ABQBDH@Z
srand
??1type_info@@UAE@XZ
__CxxFrameHandler3
memcmp
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_CxxThrowException
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_ftol2
_callnewh
malloc
free
_purecall
??1exception@@UAE@XZ
_CIsqrt
memset

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualProtect
VirtualAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
SetEvent
ReleaseMutex
WaitForSingleObject
CreateEventExW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
ReleaseSRWLockShared
EnterCriticalSection
InitializeCriticalSectionEx
CreateMutexExW
AcquireSRWLockShared
OpenEventW
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSection
CreateSemaphoreExW
DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
TlsGetValue
SetThreadPriority
TlsSetValue
ResumeThread
TerminateProcess
GetCurrentProcess
GetCurrentThread
GetThreadPriority
GetCurrentThreadId
CreateThread
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
FreeLibraryAndExitThread
GetModuleFileNameW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetLocalTime
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

mfperfhelper

ord1

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
RecordFeatureError
SubscribeFeatureStateChangeNotification

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback
CallbackMayRunLong

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegEnumKeyExW
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStringsW

ntdll

RtlGetPersistedStateLocation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 895KB - Virtual size: 895KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

474e269553446b80890c39090dd49645

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a7:48:9c:50:45:d8:be:4d:4a:5d:e6:b7:d6:f8:61:c9:9e:87:8c:41:61:46:cd:98:cb:3e:06:46:6d:cf:59:86Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-memory-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

mfperfhelper

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 895KB - Virtual size: 895KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a7:48:9c:50:45:d8:be:4d:4a:5d:e6:b7:d6:f8:61:c9:9e:87:8c:41:61:46:cd:98:cb:3e:06:46:6d:cf:59:86
Signer

.text
Size: 895KB - Virtual size: 895KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB