MrmCoreR[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MrmCoreR.dll
Size

772KB
MD5

d5496cf5df8921cfc1ef1770f98c2192
SHA1

01b7082e51d1089c8720226b5bb47e431b558b61
SHA256

a79ab7808e25b42785d3241cfcae05e20b103b2aa58bbf1f9671295de692829f
SHA512

fce7f329c8e3f050de6a37dd82bcad1a4539051b433f47eb50d04bb9810b138fa5a22557d8e962fcc770bc3fad075ad59ef7a33395cc70b2590b19fbb5eaa971
SSDEEP

12288:ZuE6kKZ+zplm9yBb098zVdLquxUclvnRaq68gLJVqdR53GRPR75:ZTttpliyBb0yVdLqNMvTgNVqdX2hv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MrmCoreR.dll

Files

MrmCoreR.dll
.dll regsvr32 windows:6 windows x86 arch:x86

abc16d97d272859209413d70ef7a892d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MrmCoreR.pdb

Imports

msvcrt

_ftol2_sse
_ftol2
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
towupper
wprintf
isalpha
_ui64tow_s
towlower
wcsnlen
qsort
qsort_s
memcmp
_wtof
wcstoul
_wcstoi64
memmove
??0exception@@QAE@ABQBD@Z
bsearch
memmove_s
memset
wcsrchr
_vsnwprintf
wcsncmp
wcschr
_itow_s
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
__CxxFrameHandler3
??1type_info@@UAE@XZ
_errno
realloc
_purecall
_except_handler4_common
_callnewh
?what@exception@@UBEPBDXZ
_wtoi
_wcsicmp
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
_wcsnicmp
iswspace
iswdigit
iswalnum
memcpy

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
HSTRING_UserSize
WindowsIsStringEmpty
WindowsGetStringLen
WindowsDeleteString
HSTRING_UserMarshal
WindowsCreateString
HSTRING_UserUnmarshal
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
HSTRING_UserFree
WindowsConcatString
WindowsDuplicateString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
RoTransformError
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateError
IsErrorPropagationEnabled

rpcrt4

IUnknown_Release_Proxy
NdrStubCall2
NdrOleAllocate
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrStubForwardingFunction
NdrOleFree
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
RpcStringFreeW
UuidToStringW
UuidCreate
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockShared
DeleteCriticalSection
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateEventW
SignalObjectAndWait
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeSRWLock

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
SizeofResource
LoadResource
FindResourceExW
FreeLibrary
GetModuleFileNameW
LoadLibraryExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx
CompareStringOrdinal

api-ms-win-core-localization-l1-2-1

GetGeoInfoW
GetUserGeoID
GetThreadPreferredUILanguages
SetThreadLocale
GetThreadLocale

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetSystemTime
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-2-1

GetFileTime
GetTempFileNameW
GetFinalPathNameByHandleW
GetFileAttributesExW
CompareFileTime
CreateDirectoryW
GetTempPathW
DeleteFileW
FlushFileBuffers
ReadFile
CreateFileW
GetFileSizeEx
GetFileAttributesW
WriteFile
FindClose
FindNextFileW
FindFirstFileW

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentThread
GetCurrentThreadId
CreateThread
OpenProcessToken
GetCurrentProcess
OpenThreadToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
DebugBreak

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-2-0

FreeSid
RevertToSelf
AddAccessAllowedAceEx
GetLengthSid
EqualSid
GetAce
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetTokenInformation

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-localization-private-l1-1-0

_OpenMuiStringCache
_AddMUIStringToCache
_GetMUIStringFromCache

combase

ord19
ord13
ord18
ord33
ord11
ord16
ord7
ord14
ord6
ord32
ord10
ord12
ord5
ord9
ord8
ord34
ord15
ord3
ord22
ord17
ord2
ord4
ord20
ord21

ntdll

RtlUnsubscribeWnfStateChangeNotification
RtlInitializeSRWLock
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlCompareUnicodeString
NtQueryInformationToken
RtlInitUnicodeString
NtQuerySystemInformation
RtlReportException
RtlSubscribeWnfStateChangeNotification

api-ms-win-appmodel-identity-l1-1-0

AppXGetOSMaxVersionTested

bcp47langs

?GetApplicationLanguages@CLanguagesListFactory@Internal@Windows@@SGJPBGPAPBVCLanguagesList@23@@Z
?GetUserLanguages@CLanguagesListFactory@Internal@Windows@@SGJPAPBVCLanguagesList@23@@Z
?IsWellFormedTag@CLanguage@Internal@Windows@@SG_NPBG@Z
?FindClosestInList@CLanguage@Internal@Windows@@QBEJPBGW4BCP47_COMPARISON_ALGORITHM@23@PAPBGPAN@Z
??0CLanguage@Internal@Windows@@QAE@PBG@Z
GetApplicationLayoutDirection
Bcp47GetDirectionality
?IsValidRegionTag@CRegion@Internal@Windows@@SG_NPBG@Z
??0CRegion@Internal@Windows@@QAE@PBG@Z
?CreateInstance@CLanguagesList@Internal@Windows@@SGJPBGPAPBV123@@Z
?GetCompositeRegionCode@CRegion@Internal@Windows@@SGII@Z
?GetCompositeRegionCode@CRegion@Internal@Windows@@QBEIXZ
?Compare@CRegion@Internal@Windows@@QBEJABV123@PAN@Z
?GetSubtagFields@CLanguage@Internal@Windows@@QBEJW4BCP47_SUBTAG_FLAGS@23@PAG@Z

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
GetInternalReferenceBlobForManifestValue
GetMergedSystemPri
GetStringValueForManifestField
MergeResourcePackPri
MergeSystemPriFiles
ResourceManagerQueueGetCurrentDepth
ResourceManagerQueueGetString
ResourceManagerQueueGetStringDirect
ResourceManagerQueueIsResourceReference
ResourceManagerQueueReset

Sections

.text
Size: 691KB - Virtual size: 691KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abc16d97d272859209413d70ef7a892d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

rpcrt4

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-private-l1-1-0

combase

ntdll

api-ms-win-appmodel-identity-l1-1-0

bcp47langs

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 691KB - Virtual size: 691KB

.orpc Size: 1024B - Virtual size: 802B

.data Size: 5KB - Virtual size: 4KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 268B

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 44KB - Virtual size: 44KB

.text
Size: 691KB - Virtual size: 691KB

.orpc
Size: 1024B - Virtual size: 802B

.data
Size: 5KB - Virtual size: 4KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 268B

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 44KB - Virtual size: 44KB