mf[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mf.dll
Size

506KB
MD5

88a821bc72cb1a935c92f453586233ef
SHA1

1a9959dc605e485537c54d38b03eae87629aa879
SHA256

c5ec33451663a359972c1ed18d591fa1ede10fbf99bef6025ac84b932babf0bc
SHA512

7367e14f9c14039dd75a49fbb64356eaa8ca7965855701aa626f6e7c7de1f6b877fda8ba71c05c479b400b3e9c8b357ecc7730e82f5a936c9f73631dda71eaac
SSDEEP

6144:zC6QDtqfQGogUSZz+u1xPM4t9nen6Dosr2KmEgOSn0UOqccMS1+fIS28plTa6LrB:+6QU8Q+uHPZt9nenzs6EgOSn0UO41QR5

Score

1^/10

Malware Config

Signatures

Files

mf.dll
.dll windows:6 windows x86 arch:x86

8fd966e0afd8b7d596910d74d58ce84e

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2013, 21:43

Not After

17/09/2014, 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:1f:31:29:a3:b0:13:e4:65:94:76:c0:4a:b0:8d:b2:71:0a:2a:fc:71:bb:35:25:86:56:41:5e:c0:d3:f0:f7
Signer

Actual PE Digest

9e:1f:31:29:a3:b0:13:e4:65:94:76:c0:4a:b0:8d:b2:71:0a:2a:fc:71:bb:35:25:86:56:41:5e:c0:d3:f0:f7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mf.pdb

Imports

msvcrt

wcsncmp
wcscat_s
_ftol2
strchr
atol
_except_handler4_common
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
_errno
_onexit
_wcsnicmp
memchr
_unlock
??3@YAXPAX@Z
_lock
strnlen
wcsnlen
memset
realloc
memmove_s
wcsrchr
_wcsicmp
wcscpy_s
_vsnwprintf
??2@YAPAXI@Z
memcpy_s
_purecall
??_V@YAXPAX@Z
malloc
free
??_U@YAPAXI@Z
memmove
memcpy
wcsncpy_s
__dllonexit
memcmp

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
LoadResource
SizeofResource
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
FindResourceExW
LoadStringW
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
Sleep
CreateEventW
SetEvent
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSection
InitializeSRWLock
EnterCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventUnregister

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
CreateThread
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-memory-l1-1-2

MapViewOfFile
UnmapViewOfFile
VirtualAlloc
CreateFileMappingW
VirtualProtect
VirtualFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-1

GetUserDefaultLCID

api-ms-win-core-file-l1-2-1

WriteFile
CreateFileW
GetFileSize
ReadFile
GetDiskFreeSpaceW
GetFullPathNameW
GetFinalPathNameByHandleW

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsA

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetVersionExA
GetSystemTimeAsFileTime
GetLocalTime
GlobalMemoryStatusEx

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException
LoadLibraryW
GetComputerNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathSkipRootW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

ntdll

RtlNtStatusToDosError

api-ms-win-core-io-l1-1-1

DeviceIoControl

rpcrt4

I_RpcMapWin32Status
UuidFromStringW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

Exports

Exports

AppendPropVariant
ConvertPropVariant
CopyPropertyStore
CreateNamedPropertyStore
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ExtractPropVariant
MFCreate3GPMediaSink
MFCreateAC3MediaSink
MFCreateADTSMediaSink
MFCreateASFByteStreamPlugin
MFCreateASFContentInfo
MFCreateASFIndexer
MFCreateASFIndexerByteStream
MFCreateASFMediaSink
MFCreateASFMediaSinkActivate
MFCreateASFMultiplexer
MFCreateASFProfile
MFCreateASFProfileFromPresentationDescriptor
MFCreateASFSplitter
MFCreateASFStreamSelector
MFCreateASFStreamingMediaSink
MFCreateASFStreamingMediaSinkActivate
MFCreateAggregateSource
MFCreateAppSourceProxy
MFCreateAudioRenderer
MFCreateAudioRendererActivate
MFCreateByteCacheFile
MFCreateCacheManager
MFCreateCredentialCache
MFCreateDeviceSource
MFCreateDeviceSourceActivate
MFCreateDrmNetNDSchemePlugin
MFCreateFMPEG4MediaSink
MFCreateFileBlockMap
MFCreateFileSchemePlugin
MFCreateHttpSchemePlugin
MFCreateLPCMByteStreamPlugin
MFCreateMP3ByteStreamPlugin
MFCreateMP3MediaSink
MFCreateMPEG4MediaSink
MFCreateMediaProcessor
MFCreateMediaSession
MFCreateMuxSink
MFCreateNSCByteStreamPlugin
MFCreateNetSchemePlugin
MFCreatePMPHost
MFCreatePMPMediaSession
MFCreatePMPServer
MFCreatePresentationClock
MFCreatePresentationDescriptorFromASFProfile
MFCreateProtectedEnvironmentAccess
MFCreateProxyLocator
MFCreateRemoteDesktopPlugin
MFCreateSAMIByteStreamPlugin
MFCreateSampleCopierMFT
MFCreateSampleGrabberSinkActivate
MFCreateSecureHttpSchemePlugin
MFCreateSequencerSegmentOffset
MFCreateSequencerSource
MFCreateSequencerSourceRemoteStream
MFCreateSimpleTypeHandler
MFCreateSoundEventSchemePlugin
MFCreateSourceResolver
MFCreateStandardQualityManager
MFCreateTopoLoader
MFCreateTopology
MFCreateTopologyNode
MFCreateTranscodeProfile
MFCreateTranscodeSinkActivate
MFCreateTranscodeTopology
MFCreateTranscodeTopologyFromByteStream
MFCreateUrlmonSchemePlugin
MFCreateVideoRenderer
MFCreateVideoRendererActivate
MFCreateWMAEncoderActivate
MFCreateWMVEncoderActivate
MFEnumDeviceSources
MFGetLocalId
MFGetMultipleServiceProviders
MFGetService
MFGetSupportedMimeTypes
MFGetSupportedSchemes
MFGetSystemId
MFGetTopoNodeCurrentType
MFLoadSignedLibrary
MFRR_CreateActivate
MFReadSequencerSegmentOffset
MFRequireProtectedEnvironment
MFShutdownObject
MFTranscodeGetAudioOutputAvailableTypes
MergePropertyStore

Sections

.text
Size: 425KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8fd966e0afd8b7d596910d74d58ce84e

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

9e:1f:31:29:a3:b0:13:e4:65:94:76:c0:4a:b0:8d:b2:71:0a:2a:fc:71:bb:35:25:86:56:41:5e:c0:d3:f0:f7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

ntdll

api-ms-win-core-io-l1-1-1

rpcrt4

api-ms-win-core-heap-obsolete-l1-1-0

Exports

Exports

Sections

.text Size: 425KB - Virtual size: 425KB

.data Size: 5KB - Virtual size: 7KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 26KB - Virtual size: 26KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

9e:1f:31:29:a3:b0:13:e4:65:94:76:c0:4a:b0:8d:b2:71:0a:2a:fc:71:bb:35:25:86:56:41:5e:c0:d3:f0:f7
Signer

.text
Size: 425KB - Virtual size: 425KB

.data
Size: 5KB - Virtual size: 7KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 26KB - Virtual size: 26KB