atmfd[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

atmfd.dll
Size

303KB
MD5

8a6597dcfd34e6645fe0bc6e8daf3801
SHA1

17801b53b9d2445f19a71fcd349b15ceb24ae612
SHA256

e77fc25d65d476945bd21748c352e1a9cb6ef8fd19fd010d9792f371607b0cf9
SHA512

519d954668de9cae82008940ccff010102fd2a2a7704b62845e2954ffba75004cd8998da6ca8f34133b55d5f271559f51d57c4a6214ddd7d6a2b8edf0826dbd7
SSDEEP

6144:Am8jaBWlERMiN5HO3bfhuOg/0bG/Nb5IRjCybODbpP0OueCJtj0RS:AFHlEZN5HO3bf8R/0INb2RjVbODbpBQj

Score

1^/10

Malware Config

Signatures

Files

atmfd.dll
.dll windows:6 windows x86 arch:x86

5de3f2f2d321ea0bae51b3cf9fdd0ba6

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:51:94:2d:a9:b8:e3:c6:c8:4d:21:e8:1f:af:0d:fd:e3:95:48:63:7b:9f:86:f2:c0:7a:f5:57:e0:9b:04:3d
Signer

Actual PE Digest

76:51:94:2d:a9:b8:e3:c6:c8:4d:21:e8:1f:af:0d:fd:e3:95:48:63:7b:9f:86:f2:c0:7a:f5:57:e0:9b:04:3d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atmfd.pdb

Imports

win32k.sys

EngFntCacheFault
EngFntCacheAlloc
EngFntCacheLookUp
EngCreateSemaphore
EngReleaseSemaphore
EngAcquireSemaphore
EngSetLastError
EngMulDiv
XFORMOBJ_iGetXform
FONTOBJ_pxoGetXform
FONTOBJ_pifi
EngGetCurrentCodePage
PATHOBJ_bPolyLineTo
PATHOBJ_bPolyBezierTo
PATHOBJ_bCloseFigure
PATHOBJ_bMoveTo
EngGetFileChangeTime
EngGetFilePath
EngUnmapFontFileFD
EngUnmapFontFile
EngFreeModule
EngAllocMem
EngMapModule
EngLoadModule
EngLoadModuleForWrite
EngMapFontFileFD
EngMapFontFile
EngUnicodeToMultiByteN
EngMultiByteToUnicodeN
EngMultiByteToWideChar
FLOATOBJ_MulFloat
EngFreeMem
FLOATOBJ_GetLong
FLOATOBJ_Neg
FLOATOBJ_AddFloat
FLOATOBJ_Add
FLOATOBJ_DivLong
FLOATOBJ_AddLong
FLOATOBJ_MulLong
FLOATOBJ_SetLong
EngBugCheckEx
RtlUnwind
RtlUnicodeToMultiByteN

Sections

.text
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5de3f2f2d321ea0bae51b3cf9fdd0ba6

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

76:51:94:2d:a9:b8:e3:c6:c8:4d:21:e8:1f:af:0d:fd:e3:95:48:63:7b:9f:86:f2:c0:7a:f5:57:e0:9b:04:3dSigner

Headers

File Characteristics

PDB Paths

Imports

win32k.sys

Sections

.text Size: 218KB - Virtual size: 217KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 29KB - Virtual size: 33KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 13KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

76:51:94:2d:a9:b8:e3:c6:c8:4d:21:e8:1f:af:0d:fd:e3:95:48:63:7b:9f:86:f2:c0:7a:f5:57:e0:9b:04:3d
Signer

.text
Size: 218KB - Virtual size: 217KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 29KB - Virtual size: 33KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 13KB