MMDevAPI[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MMDevAPI.dll
Size

358KB
MD5

dee3894026b0383c464bf8299d12377d
SHA1

d4c8ed32a9efd567ea9677c47310c37e3ba98409
SHA256

63f0c568be9a2e4b2ef5a917a228941f22edacb93204d9c8b78f57e12785652d
SHA512

c856949828e2460a2cc003d3ab7010fbb3420f6f2ebc594b051cc203668bf4a5f5bebc703b6208392417aab15f36e7166fc38b33cfce8e00d8dbb9c48c284ed7
SSDEEP

6144:WdcOvVUyEKFa6LI6+Qf0bhljSRSCE7FX7qM1f3Ss3X8MKZnqYReGjscdSXOpvle/:WqU2l6+lj6g7bViLXgy2Bi/EsiwI

Score

1^/10

Malware Config

Signatures

Files

MMDevAPI.dll
.dll regsvr32 windows:10 windows x86 arch:x86

6d60e28ee938fbae49a0f169eac57f7f

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dc:01:c7:5b:07:a4:bb:2d:db:66:b9:42:f1:30:02:56:37:cd:69:23:46:24:b5:3b:03:b7:6c:15:18:92:80:3e
Signer

Actual PE Digest

dc:01:c7:5b:07:a4:bb:2d:db:66:b9:42:f1:30:02:56:37:cd:69:23:46:24:b5:3b:03:b7:6c:15:18:92:80:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MMDevAPI.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wtoi
_o_calloc
_o_free
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
_except_handler4_common
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__errno
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
SizeofResource
LoadLibraryExW
GetProcAddress
GetModuleHandleExW
LoadResource
FreeLibrary
LoadStringW
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateEventW
CreateMutexExW
ReleaseSRWLockExclusive
TryEnterCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSemaphore
ReleaseMutex
InitializeSRWLock
DeleteCriticalSection
SetEvent
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared
CreateEventExW
ResetEvent
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegDeleteTreeW
RegEnumValueW
RegQueryValueExW
RegGetValueW
RegOpenKeyExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
TrySubmitThreadpoolCallback
CloseThreadpoolWait
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
ProcessIdToSessionId
GetCurrentProcessId
OpenThread
GetCurrentProcess

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
SetThreadLocale

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

NdrClientCall4
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW

ntdll

EtwUnregisterTraceGuids
RtlGetPersistedStateLocation
EtwGetTraceEnableLevel
RtlQueryPackageClaims
EtwGetTraceEnableFlags
EtwTraceMessage
ShipAssert
EtwLogTraceEvent
EtwNotificationRegister
EtwGetTraceLoggerHandle
EtwNotificationUnregister
EtwSendNotification
RtlDllShutdownInProgress
EtwRegisterTraceGuidsW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-io-l1-1-1

CancelSynchronousIo
GetOverlappedResultEx
CancelIo

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

devobj

DevObjGetDeviceInterfaceProperty
DevObjGetDeviceInterfaceAlias
DevObjGetDeviceInterfacePropertyKeys
DevObjSetDeviceInterfaceProperty
DevObjOpenDeviceInterfaceRegKey
DevObjSetDeviceProperty
DevObjGetDeviceProperty
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjOpenDeviceInterface
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjGetDeviceInstanceId
DevObjEnumDeviceInfo
DevObjGetClassDevs
DevObjDestroyDeviceInfoList

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-service-private-l1-1-0

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

propsys

PropVariantToGUID

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ActivateAudioInterfaceAsync
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 32B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d60e28ee938fbae49a0f169eac57f7f

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

dc:01:c7:5b:07:a4:bb:2d:db:66:b9:42:f1:30:02:56:37:cd:69:23:46:24:b5:3b:03:b7:6c:15:18:92:80:3eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

rpcrt4

ntdll

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-realtime-l1-1-0

devobj

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-localization-private-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 313KB - Virtual size: 312KB

RT_BSS Size: - Virtual size: 32B

.data Size: 2KB - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 212B

RT_DATA Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 18KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

dc:01:c7:5b:07:a4:bb:2d:db:66:b9:42:f1:30:02:56:37:cd:69:23:46:24:b5:3b:03:b7:6c:15:18:92:80:3e
Signer

.text
Size: 313KB - Virtual size: 312KB

RT_BSS
Size: - Virtual size: 32B

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 212B

RT_DATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 18KB