MTF[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MTF.dll
Size

163KB
MD5

c21ca671bf3406a457a5e57ddf0a3b4e
SHA1

7aa69a85f2ca771187c953356bd1d72332a57d93
SHA256

ee94388cb21b87b503e3a329f274288e9cd25364e9c115dcb5ee1a9fe775f4b4
SHA512

1779419725b74252194eab37b50ceeddf26cc982aa57429e91da03a04c2a97cdc31a78ecc718d3bef1fd884e7777097b9fe0ad3f884ebf92d484780038418c45
SSDEEP

3072:8wGQ2mbGPfzAIz1uemrvWzZPGcwsCEyG1yQHa3BoRUTG8F:Ll2AGt1dqebwsCEyO1ABoRQG8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MTF.dll

Files

MTF.dll
.dll windows:10 windows x86 arch:x86

b60d4f8a052f980df45a7c440b609754

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MTF.pdb

Imports

msvcrt

?what@exception@@UBEPBDXZ
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
_except_handler4_common
??1type_info@@UAE@XZ
__CxxFrameHandler3
memcpy
_onexit
??0exception@@QAE@ABQBD@Z
_XcptFilter
malloc
_amsg_exit
free
_initterm
??3@YAXPAX@Z
__dllonexit
_vsnprintf_s
??_V@YAXPAX@Z
realloc
wcsncmp
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
_unlock
_lock
memcpy_s
memmove
_vsnwprintf
_callnewh
memcmp
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleFileNameA
FreeLibrary

api-ms-win-core-com-l1-1-1

CoCreateInstance
StringFromGUID2
CoEnableCallCancellation
CoGetClassObject
CoDisableCallCancellation
CreateStreamOnHGlobal
CoCancelCall

api-ms-win-core-synch-l1-2-0

ReleaseMutex
SetEvent
WaitForSingleObject
Sleep
CreateEventW
ReleaseSemaphore
CreateMutexExW
InitOnceBeginInitialize
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitOnceComplete
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenSemaphoreW
InitializeSRWLock

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventWrite
EventSetInformation

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen
SysAllocString

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-rtcore-ntuser-window-l1-1-0

DispatchMessageW
TranslateMessage
PeekMessageW

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc
LocalFree

coremessaging

CoreUICreate

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

Exports

Exports

CreateInputTypeAttributes
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b60d4f8a052f980df45a7c440b609754

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-registry-l1-1-0

oleaut32

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-heap-l2-1-0

coremessaging

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-security-sddl-l1-1-0

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 144KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 144KB - Virtual size: 144KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB