cmintegrator[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

cmintegrator.dll
Size

29KB
MD5

9a8977d055802f1382d4e823c04fdf4b
SHA1

356dbe2daba1148c0283ab72a7225a002867e23f
SHA256

21760ef71dd5589203294af5b36b8f710375d7045c20c2c31a0951ffac23d0c5
SHA512

d2aee69f526c9c57c75c0827876a95ab1fef27380aba7bfb46fdbb0a770daf312201eac0b262a7bf3b57e9f302060f053a25f9545d71a8563abc193b0b53a9f2
SSDEEP

384:l0BDMYDSDew5S8UX2hH2biUJtv+8OLTmhkuSxzq/mWT8WeoZFjZ:yBvrwaXBPL1OTGkq/r3F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cmintegrator.dll

Files

cmintegrator.dll
.dll windows:10 windows x86 arch:x86

9e4cae561be87265849e257ac59f9845

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cmintegrator.pdb

Imports

msvcrt

_wcsicmp
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

api-ms-win-core-misc-l1-1-0

Sleep

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

iphlpapi

ConvertInterfaceGuidToLuid
ConvertInterfaceLuidToIndex
GetBestRoute2
InternalGetIPPhysicalInterfaceForDestination
CloseGetIPPhysicalInterfaceForDestination

ntdll

EtwTraceMessage

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids

ws2_32

FreeAddrInfoW
GetAddrInfoW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
WaitForSingleObject
CreateEventW
AcquireSRWLockShared
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
LeaveCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

rpcrt4

RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall4

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateThread

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

VpnCmOracleCheckVpnAvailability
VpnCmOracleInitialize
VpnCmOracleShutdown

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e4cae561be87265849e257ac59f9845

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-misc-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

iphlpapi

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

ws2_32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

rpcrt4

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB