dmcmnutils[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

dmcmnutils.dll
Size

381KB
MD5

1d74426d7b6620e7ac06d4781aa431e4
SHA1

df2c92e56fdbe08e064b157bb2911c0bc89dcd60
SHA256

36060b7d495a239800a3fef0174515f42eca2cb0b1353ded5074b7a2a45afa39
SHA512

a1703eb187bdd3607311df7ff96489f70ffc99c1315ecbc91ed851c3ab9317e89e43dfdb04d8d6a5d54885947e754f36c6f53476e8037f5b16ff2621d9312107
SSDEEP

6144:VBvMElz6dxsUE1fDzbvFi12QBFISmJ17qI3B8G2KHzVxdVU/+Ogum:V5EI/vMpFItOYBrLU/+T

Score

1^/10

Malware Config

Signatures

Files

dmcmnutils.dll
.dll windows:10 windows x86 arch:x86

a6c5aa760ca575489e6c6607af1c593a

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-11-2023 19:20

Not After

14-11-2024 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:2f:9a:2f:d4:a2:b5:33:ff:bf:55:5f:3d:5c:b6:4e:5a:12:44:79:b9:3d:cb:f1:19:29:f3:f9:ff:bf:be:b4
Signer

Actual PE Digest

3b:2f:9a:2f:d4:a2:b5:33:ff:bf:55:5f:3d:5c:b6:4e:5a:12:44:79:b9:3d:cb:f1:19:29:f3:f9:ff:bf:be:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dmcmnutils.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wsplitpath_s
_o__wtoi64
_o_ceil
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcstod
_o_wcstoul
_except_handler4_common
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
wcsstr
wcschr
__std_terminate
__CxxFrameHandler3
memchr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleW
LoadStringW
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TerminateProcess
GetCurrentProcess
OpenThreadToken
CreateThread
GetCurrentThread
ProcessIdToSessionId
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoWaitForMultipleHandles
PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoRevertToSelf
StringFromCLSID
StringFromGUID2
CoCreateGuid

api-ms-win-core-synch-l1-2-0

Sleep
WakeByAddressAll
WaitOnAddress

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
CreateEventExW
CreateEventW
SetEvent
CreateMutexExW
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
ResetEvent
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
InitializeCriticalSectionEx
AcquireSRWLockShared

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte
FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

crypt32

CryptEncodeObjectEx
CryptSignMessage
CryptAcquireCertificatePrivateKey

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegOpenCurrentUser
RegGetValueW
RegDeleteValueW
RegSetValueExW

ntdll

RtlPublishWnfStateData
RtlQueryWnfStateData
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
RtlIsStateSeparationEnabled
RtlIsMultiSessionSku
RtlGetVersion
RtlGetPersistedStateLocation
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlAllocateHeap
NtSetInformationToken
RtlInitUnicodeString
RtlFreeHeap
NtQuerySecurityAttributesToken
RtlCompareMemory
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum

rpcrt4

UuidCreate

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW
FindNextFileW
CompareFileTime
FindClose
FindFirstFileW
CreateFileW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
DeleteFileW
CreateDirectoryW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindNextComponentW
PathFileExistsW
PathFindFileNameW

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension
PathAllocCombine
PathCchCombine
PathCchRenameExtension

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptDuplicateHash

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetSystemFirmwareTable

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

ncrypt

NCryptSetProperty
NCryptExportKey
NCryptOpenStorageProvider
NCryptIsAlgSupported
NCryptFreeObject
NCryptCreateClaim
NCryptGetProperty
NCryptOpenKey

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
RevertToSelf
CopySid
ImpersonateLoggedOnUser
FreeSid
EqualSid
CheckTokenMembership
GetLengthSid
GetTokenInformation

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

msvcp_win

?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xoverflow_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ

bcrypt

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptDestroyHash
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDecrypt
BCryptDestroyKey
BCryptEncrypt
BCryptOpenAlgorithmProvider

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

tbs

Tbsip_Context_Close
Tbsi_GetDeviceInfo
Tbsip_Submit_Command
Tbsi_Get_TCG_Log_Ex
Tbsi_Context_Create

Exports

Exports

BigStrcat
BinaryToHexString
ComputeHmac
CopyString
CreateBstrArray
DMGetClientHardwareUID
DMGetDeviceClientID
DMSetDeviceClientID
DecodeBase64W
DmCancelGetUserPermissionAsync
DmCheckIfAadAccountLoggedOn
DmCopyDirectoryRecursive
DmCreateFileSafe
DmCreateTask
DmDeleteTask
DmDisableTask
DmEnableTask
DmEnumUsers
DmGenerateAttestationClaims
DmGetAadDeviceMdmEnrollmentResourceUrlWithDiscovery
DmGetAadDeviceToken
DmGetAadDeviceTokenWithDiscovery
DmGetAadEnrollmentResource
DmGetAadUserToken
DmGetActiveUserSid
DmGetCurrentUserSid
DmGetCurrentUserToken
DmGetEnrollmentTypeName
DmGetEnrollmentTypeValue
DmGetFileSize
DmGetIMEI
DmGetSmbiosSerialNumber
DmGetTpmInfo
DmGetTpmIsAlgorithmSupported
DmGetTpmState
DmGetUserEditFieldInput
DmGetUserPermission
DmGetUserPermissionAsync
DmGetUserSidFromToken
DmGetUserTokenFromSid
DmImpersonate
DmInformUser
DmInitializeContainer
DmInvalidateAadDeviceToken
DmInvalidateAadUserToken
DmIsDeviceConnected
DmIsDeviceRoaming
DmIsRunningInSystemContext
DmIsSystemOrAdmin
DmIsSystemOrUserIsAdmin
DmIsTaskScheduled
DmIsTaskScheduledAndEnabled
DmMdmSign
DmPlayNotificationSound
DmRaiseToastNotification
DmRaiseToastNotificationAndWait
DmRegisterRoamingNotification
DmReleaseContainer
DmRemoveToastNotification
DmRemoveToastNotificationByExecutablePath
DmRequestAadUserToken
DmRevertToSelf
DmRunTask
DmSetWindowsAIKStorageLocation
DmStartContainerActivity
DmStopContainerActivity
DmUnregisterRoamingNotification
DmWnfGetNotification
DmWnfPublish
DmWnfQuery
EncodeBase64
EncodeBase64W
EscapeStringW
GetHeader
GetICCID
GetIMEI
GetIMSI
GetIMSIByIccID
GetPGListRegKeyName
GetPhoneNumber
GetPhoneUID
Hash_Create
Hash_Delete
Hash_Destroy
Hash_DestroyCallback
Hash_EnumCallback
Hash_Get
Hash_Insert
Hash_SetBucketThreshold
HexStringToBinary
InvStrCmpIW
InvStrCmpNIW
InvStrCmpNW
InvStrCmpW
IsDesktopSku
IsPhoneOS
IsServerVersionOrAbove
IsWvdFeatureAllowed
IsWvdSku
MBToUnicode
OmDmRegistryAllocAndGetString
OmaDmRegistryDeleteValue
OmaDmRegistryGetAllSubKeys
OmaDmRegistryGetAllValues
OmaDmRegistryGetBinary
OmaDmRegistryGetDWORD
OmaDmRegistryGetString
OmaDmRegistryRetrieveCurrentUsersHKCU
OmaDmRegistrySetBinary
OmaDmRegistrySetDWORD
OmaDmRegistrySetString
QueryPolicy
SafeMultiByteToWideChar
SafeStringToDword
SafeWideCharToMultiByte
SetConnectionPriority
SetPolicy
UnicodeToMB

Sections

.text
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6c5aa760ca575489e6c6607af1c593a

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

3b:2f:9a:2f:d4:a2:b5:33:ff:bf:55:5f:3d:5c:b6:4e:5a:12:44:79:b9:3d:cb:f1:19:29:f3:f9:ff:bf:be:b4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

crypt32

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

ntdll

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-registry-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

oleaut32

ncrypt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-lsalookup-l1-1-2

api-ms-win-core-apiquery-l1-1-0

msvcp_win

bcrypt

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

tbs

Exports

Exports

Sections

.text Size: 335KB - Virtual size: 335KB

.data Size: 1KB - Virtual size: 3KB

.idata Size: 12KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

3b:2f:9a:2f:d4:a2:b5:33:ff:bf:55:5f:3d:5c:b6:4e:5a:12:44:79:b9:3d:cb:f1:19:29:f3:f9:ff:bf:be:b4
Signer

.text
Size: 335KB - Virtual size: 335KB

.data
Size: 1KB - Virtual size: 3KB

.idata
Size: 12KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB