cmutil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cmutil.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
cmutil.dll
Resource
win10v2004-20240426-en
General
-
Target
cmutil.dll
-
Size
46KB
-
MD5
879c99433cb7f3147be4d58e01d53221
-
SHA1
52314e726177927cf2a06f707bef1063ed1f7d91
-
SHA256
ab5faf2a40c43deaabd84d57c40ae6b04a101172e208beb14fb5c0256d0d548b
-
SHA512
8e39a341411eb60d31312de4d65dc154aac3a12c61f159837a56e48bcbbae03b5978ee17b0283347cb7ed2b1f5ce0672ddbc05f88f184fd844ef5e5661abb223
-
SSDEEP
768:jZDVlTPfhFVewintKJ6yTZC0PWctsmWJs4QEdMHEU4uvg+kiNIPEEe51:PVPfP4HIJ9PvtsbJs4SHEU4ag+kiNIPe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cmutil.dll
Files
-
cmutil.dll.dll windows:6 windows x86 arch:x86
59e85166dcccacf6dec2a9697953b42e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnwprintf
memset
_vsnprintf
advapi32
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyExA
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
gdi32
GetObjectA
CreateFontIndirectW
DeleteObject
kernel32
TlsGetValue
TlsSetValue
GetStringTypeExW
IsDBCSLeadByte
GetStringTypeExA
MultiByteToWideChar
SetLastError
CompareStringW
CompareStringA
HeapReAlloc
TlsAlloc
DisableThreadLibraryCalls
TlsFree
GetDateFormatW
GetTimeFormatW
LoadLibraryW
GetProcAddress
GetCurrentProcess
FreeLibrary
GetFileSize
SetEndOfFile
GetVersionExW
GetSystemDirectoryW
GetTempPathW
lstrcmpiW
GetFileAttributesW
CreateDirectoryW
lstrcmpW
FlushFileBuffers
SetFilePointer
WriteFile
ExpandEnvironmentStringsW
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalFree
LocalAlloc
LoadLibraryA
GetLastError
GetTickCount
GetPrivateProfileStringA
lstrlenA
CloseHandle
CreateFileA
GetPrivateProfileIntA
ExpandEnvironmentStringsA
WritePrivateProfileStringA
GetPrivateProfileStringW
lstrlenW
CreateFileW
GetPrivateProfileIntW
WritePrivateProfileStringW
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
user32
LoadStringA
SendMessageW
LoadImageA
CharPrevW
CharUpperW
CharLowerW
WinHelpW
CharNextW
CharNextA
LoadStringW
GetSystemMetrics
LoadImageW
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Exports
Exports
??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
??0CRandom@@QAE@I@Z
??0CRandom@@QAE@XZ
??0CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
??4CIniW@@QAEAAV0@ABV0@@Z
??4CRandom@@QAEAAV0@ABV0@@Z
??4CmLogFile@@QAEAAV0@ABV0@@Z
??_FCIniA@@QAEXXZ
??_FCIniW@@QAEXXZ
?Banner@CmLogFile@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IBEHPAUHKEY__@@PBD1PBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IBEHPAUHKEY__@@PBG1PBEKK@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?Clear@CIniA@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?Clear@CmLogFile@@QAEXH@Z
?CloseFile@CmLogFile@@AAEJXZ
?DeInit@CmLogFile@@QAEJXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?GPPB@CIniA@@QBEHPBD0H@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GPPI@CIniA@@QBEKPBD0K@Z
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?Generate@CRandom@@QAEHXZ
?GetFile@CIniA@@QBEPBDXZ
?GetFile@CIniW@@QBEPBGXZ
?GetHInst@CIniA@@QBEPAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?GetPrimaryFile@CIniA@@QBEPBDXZ
?GetPrimaryFile@CIniW@@QBEPBGXZ
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GetRegPath@CIniA@@QBEPBDXZ
?GetRegPath@CIniW@@QBEPBGXZ
?GetSection@CIniA@@QBEPBDXZ
?GetSection@CIniW@@QBEPBGXZ
?Init@CRandom@@QAEXK@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?IsEnabled@CmLogFile@@QAEHXZ
?LoadEntry@CIniA@@IBEPADPBD@Z
?LoadEntry@CIniW@@IBEPAGPBG@Z
?LoadSection@CIniA@@QBEPADPBD@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AAEJXZ
?SetEntry@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniA@@QAEXK@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
?SetFile@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniA@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetRegPath@CIniA@@QAEXPBD@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniA@@QAEXPBD@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetWriteICSData@CIniA@@QAEXH@Z
?SetWriteICSData@CIniW@@QAEXH@Z
?Start@CmLogFile@@QAEJH@Z
?Stop@CmLogFile@@QAEJXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniA@@QAEXPBD0K@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniA@@QAEXPBD00@Z
?WPPS@CIniW@@QAEXPBG00@Z
?Write@CmLogFile@@AAEJPAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmMoveMemory
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
CmWinHelp
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ