dmutil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dmutil.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dmutil.dll
Resource
win10v2004-20240508-en
General
-
Target
dmutil.dll
-
Size
19KB
-
MD5
d25b4e59a0d37a972c1b1d4a48e82c41
-
SHA1
8fe27c3b4c29ee3314c4564ad2dc9712f2799bf9
-
SHA256
dbbbca8c1252747c8b3dd6add8f96fc676b152a42acd2fa546d7794df8f42026
-
SHA512
d24bd5e302dbe52e165785cbe4205124b416d1c871b1b3d43c1916482722d2e7ca2fd42b7acd80964c22b59494752115bab64fb24cc8ce168b93b5e0b9c0b502
-
SSDEEP
384:imxX2YcfsP5colI1cyG+u///OR/IXW6uLlucWae8W/:7cg2jcyGpU/iZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dmutil.dll
Files
-
dmutil.dll.dll windows:6 windows x86 arch:x86
579c43a344d28a90973cbbc0942c9fa6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnprintf
wcstok
memcpy
memset
malloc
free
mbstowcs
_wgetenv
??2@YAPAXI@Z
_XcptFilter
_initterm
_amsg_exit
_except_handler4_common
_vsnwprintf
ntdll
RtlFreeUnicodeString
NtOpenFile
RtlCreateUnicodeString
NtSetBootEntryOrder
NtQueryBootEntryOrder
NtAddBootEntry
NtSetInformationFile
NtQueryInformationFile
RtlAdjustPrivilege
NtWriteFile
NtReadFile
NtDeviceIoControlFile
NtClose
VerSetConditionMask
api-ms-win-core-localregistry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
kernel32
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
GetLastError
DelayLoadFailureHook
LoadLibraryW
GetProcAddress
FreeLibrary
VerifyVersionInfoW
GetCurrentProcess
GetCurrentDirectoryW
Sleep
HeapFree
GetProcessHeap
HeapAlloc
lstrlenW
lstrlenA
CreateThread
FormatMessageW
LocalFree
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcmpW
DeleteCriticalSection
Exports
Exports
AddEntryBootFileGpt
AddEntryBootFileMbr
CoDisableDynamicVolumes
DisplayError
DisplayErrorRgszw
DllMain
DmCommonNtOpenFile
DynamicSupport
FTrace
FTraceValist
FreeRgszw
GetErrorData
GetInstallDirectoryPath
GetSystemVolume
IsPersonalSKU
LowAcquirePrivilege
LowGetPartitionInfo
LowNtAddBootEntry
LowNtReadFile
LowNtReadOnlyAttributeOff
LowNtWriteFile
RgszwDupRgszw
RgszwFromArgs
RgszwFromValist
SafeLoadVdsService
ShowMessage
ShowMessageValist
SzwDupSzw
SzwFromSza
TranslateError
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ