cmintegrator[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cmintegrator.dll
Size

29KB
MD5

da4d8df1ad5b632931d9f4a3ae9d506b
SHA1

2a1590278f8491904fb11c18f2ce9efb8f960974
SHA256

f3de5c95dc6c27b7fcb81af298434741858e8d062cc83450c9c4e701b2215eb2
SHA512

1ea0fef74e60ca6365017e7aa4b795be9a113a2f1ad3629fb3f7c0b78f0c3bd683097ef7c122eb4b3d8b011fae7a6fb49159b88d63469b1c0385c7d9fd07d1a2
SSDEEP

384:lvBDMYKDew5S8UX2hH2biUJtv+8OLTmGkuSBzwQ/CWQ8WFoZFjZ:ZBHwaXBPL1OTRkIQ/0KF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cmintegrator.dll

Files

cmintegrator.dll
.dll windows:10 windows x86 arch:x86

9e4cae561be87265849e257ac59f9845

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cmintegrator.pdb

Imports

msvcrt

_wcsicmp
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

api-ms-win-core-misc-l1-1-0

Sleep

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

iphlpapi

ConvertInterfaceGuidToLuid
ConvertInterfaceLuidToIndex
GetBestRoute2
InternalGetIPPhysicalInterfaceForDestination
CloseGetIPPhysicalInterfaceForDestination

ntdll

EtwTraceMessage

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids

ws2_32

FreeAddrInfoW
GetAddrInfoW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
WaitForSingleObject
CreateEventW
AcquireSRWLockShared
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
LeaveCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

rpcrt4

RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall4

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateThread

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

VpnCmOracleCheckVpnAvailability
VpnCmOracleInitialize
VpnCmOracleShutdown

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e4cae561be87265849e257ac59f9845

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-misc-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

iphlpapi

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

ws2_32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

rpcrt4

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB