MMDevAPI[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MMDevAPI.dll
Size

344KB
MD5

531d629f52a698f7dd5cafc43350c989
SHA1

918fc73ed7b7606b61bd483497592f9e0df23329
SHA256

3c0befa4232744c1989744b0ccf7e767b5f0be4e9834a0fa5699355c0e600dfe
SHA512

ec8a0cca2bea923db796be5edf5fb159625ce66bb5eaaf0f2b66bfd9043ca4971051782e2e97d75278116690b627d3a952739c0acf4cd3f082d5704b7906ca2e
SSDEEP

6144:+zciJckVB+VPthT4bpqivuMy8dc5hjG/wKLH4rnuI9RXMQ2zqb7V59565bL:qxJckSPrT+qivuMy8dc5hjG/wKL0nuI2

Score

1^/10

Malware Config

Signatures

Files

MMDevAPI.dll
.dll regsvr32 windows:10 windows x86 arch:x86

b860f30b4ba68540bd07e64aff1e4523

Code Sign

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2016, 20:39

Not After

11/01/2018, 20:39

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:67:63:28:d1:51:bc:36:c4:a1:7b:45:41:2d:fd:a9:78:22:3d:50:c4:87:e9:03:47:21:0e:fc:df:a6:47:8f
Signer

Actual PE Digest

be:67:63:28:d1:51:bc:36:c4:a1:7b:45:41:2d:fd:a9:78:22:3d:50:c4:87:e9:03:47:21:0e:fc:df:a6:47:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MMDevAPI.pdb

Imports

msvcrt

_vsnwprintf
??1type_info@@UAE@XZ
realloc
_initterm
_amsg_exit
?terminate@@YAXXZ
_XcptFilter
_lock
_unlock
_onexit
memset
__CxxFrameHandler3
_vsnprintf
__dllonexit
_errno
_except_handler4_common
memcmp
_CxxThrowException
wcstol
_ftol2_sse
_wtoi
wcsncmp
_wcsicmp
wcstoul
memmove_s
calloc
wcscat_s
wcscpy_s
_resetstkoflw
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
memcpy

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
LoadStringW
GetModuleFileNameW
GetModuleHandleW
SizeofResource
FindResourceExW
LoadResource
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
AcquireSRWLockExclusive
DeleteCriticalSection
CreateEventW
ReleaseSRWLockShared
InitializeSRWLock
OpenSemaphoreW
SetEvent
WaitForSingleObjectEx
ReleaseSemaphore
CreateEventExW
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
ResetEvent
Sleep
ReleaseSRWLockExclusive
TryEnterCriticalSection
InitOnceExecuteOnce
CreateMutexExW
InitializeCriticalSection

api-ms-win-core-heap-l1-2-0

HeapDestroy
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-2

ProcessIdToSessionId
GetCurrentThreadId
OpenThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
CompareStringOrdinal

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale
FormatMessageW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

RpcBindingFromStringBindingW
NdrClientCall4
RpcStringFreeW
RpcStringBindingComposeW

ntdll

EtwSendNotification
EtwNotificationUnregister
EtwNotificationRegister
EtwLogTraceEvent
ShipAssert
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlQueryPackageClaims
EtwTraceMessage

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolWorkCallbacks
CreateThreadpoolIo
CreateThreadpoolTimer
CancelThreadpoolIo

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-io-l1-1-1

CancelSynchronousIo
DeviceIoControl
CancelIoEx
GetOverlappedResultEx

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount64
GetLocalTime
GetSystemTime
GetTickCount

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-service-private-l1-1-1

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-core-file-l1-2-1

CreateFileW
CompareFileTime

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

devobj

DevObjGetDeviceInterfacePropertyKeys
DevObjGetDeviceInterfaceAlias
DevObjGetDeviceInterfaceProperty
DevObjOpenDeviceInterfaceRegKey
DevObjSetDeviceProperty
DevObjGetDeviceProperty
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjOpenDeviceInterface
DevObjOpenDeviceInfo
DevObjGetDeviceInstanceId
DevObjEnumDeviceInfo
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList
DevObjSetDeviceInterfaceProperty

propsys

PropVariantToGUID

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ActivateAudioInterfaceAsync
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 32B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b860f30b4ba68540bd07e64aff1e4523

Code Sign

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

be:67:63:28:d1:51:bc:36:c4:a1:7b:45:41:2d:fd:a9:78:22:3d:50:c4:87:e9:03:47:21:0e:fc:df:a6:47:8fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

rpcrt4

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-localization-private-l1-1-0

api-ms-win-core-profile-l1-1-0

devobj

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 298KB - Virtual size: 298KB

RT_BSS Size: - Virtual size: 32B

.data Size: 2KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 212B

RT_DATA Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

be:67:63:28:d1:51:bc:36:c4:a1:7b:45:41:2d:fd:a9:78:22:3d:50:c4:87:e9:03:47:21:0e:fc:df:a6:47:8f
Signer

.text
Size: 298KB - Virtual size: 298KB

RT_BSS
Size: - Virtual size: 32B

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 212B

RT_DATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB