MiracastReceiver[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MiracastReceiver.dll
Size

778KB
MD5

a5b4100a4945bf7f0d972a01fa38f077
SHA1

f9c4cd0694b7df7f891afa4982496e283c5dc8c6
SHA256

165345f570ee83e54c692d7dfecd37ad90aba4d96a7e206bbe12cf3e9beee519
SHA512

12a81147e5357544c5d4644646910f3850d1eb9d0625c43627e26b1eb3380870a0dbfd2d820f15aeb06f8227a83941b57f0170e50b3ac0f05d1ec8b0f5f4f4de
SSDEEP

24576:Pn7iiKEa/b0ayXQ/2pZu6uFrLo5tKQbGHUiCQxFhMC:Pn7iiK0Q/CA6uefG0GA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MiracastReceiver.dll

Files

MiracastReceiver.dll
.dll windows:10 windows x86 arch:x86

646486a6d979f55a962675d40b50dd54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MiracastReceiver.pdb

Imports

msvcrt

_ftol2
memcmp
memcpy
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_callnewh
strchr
strtoul
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
towupper
iswalpha
iswdigit
_ultow_s
rand_s
memmove
realloc
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcsrchr
_wtoi
wcstok_s
wcschr
??3@YAXPAX@Z
_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
_CxxThrowException
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibraryAndExitThread
FreeLibrary
LockResource
LoadResource
SizeofResource
DisableThreadLibraryCalls
GetModuleFileNameA
FindStringOrdinal
GetModuleFileNameW
LoadStringW
GetModuleHandleExW
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
CreateEventW
SetEvent
Sleep
LeaveCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateEventA
AcquireSRWLockExclusive
CreateEventExW
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSection
InitOnceExecuteOnce
DeleteCriticalSection
ReleaseSRWLockShared
ResetEvent

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
SetThreadPriority
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
OpenProcess
TlsSetValue
TlsFree
TlsAlloc
CreateThread
GetThreadId
GetProcessId
OpenProcessToken
OpenThreadToken

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-shcore-thread-l1-1-0

SHCreateThreadRef
SHSetThreadRef

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

rpcrt4

NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient14
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient12
ObjectStublessClient24
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Connect
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient3
ObjectStublessClient22
ObjectStublessClient16
NdrProxyForwardingFunction3
ObjectStublessClient11
ObjectStublessClient21
CStdStubBuffer2_CountRefs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemTime

msvcp110_win

_Strxfrm
??_7_Facet_base@std@@6B@
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Winerror_map@std@@YAPBDH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPBDH@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
??_7facet@locale@std@@6B@
?_Xout_of_range@std@@YAXPBD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
_Strcoll
??0_Locinfo@std@@QAE@PBD@Z

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

ntdll

RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlNtStatusToDosError
RtlQueryWnfStateData
RtlPublishWnfStateData

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
CallbackMayRunLong
CreateThreadpoolTimer

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegGetValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

oleaut32

SysFreeString
VariantInit

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW
FindResourceA

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

wmi

WmiDevInstToInstanceNameW
WmiOpenBlock
WmiCloseBlock
WmiExecuteMethodW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 706KB - Virtual size: 705KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

646486a6d979f55a962675d40b50dd54

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-util-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

msvcp110_win

api-ms-win-core-string-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-legacy-l1-1-0

oleaut32

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

wmi

Exports

Exports

Sections

.text Size: 706KB - Virtual size: 705KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 692B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 58KB - Virtual size: 57KB

.text
Size: 706KB - Virtual size: 705KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 692B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 58KB - Virtual size: 57KB