MrmIndexer[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MrmIndexer.dll
Size

588KB
MD5

6bb892a6d0ed62477c53899ef6762b76
SHA1

4419863b51beab5bb7a1c510505a5783784d22a3
SHA256

25cd543a6003364d848e3fd950415c02a204e178207040505bbaa308e47ff9c1
SHA512

a41dd120095642cb72313c2737bdea460409d79885449b7ca84e598cc91a89dbc01b6c916c6ed1840228b134909bced4fe7fc76692a337a48af651f61b54ae10
SSDEEP

6144:FbIqv8Qtg38+KorxLCUIZuUvnYIrkQMsa1O8XFS6FKUumbhfb0Pf2UtiZqV:4QgbJIZzvnrbQ2UPbhfgfpiIV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MrmIndexer.dll

Files

MrmIndexer.dll
.dll windows:6 windows x86 arch:x86

9b1a65f74a5068e4c48b018e7f7af2ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MrmIndexer.pdb

Imports

msvcrt

__uncaught_exception
abort
__crtGetStringTypeW
__crtLCMapStringW
__mb_cur_max
__pctype_func
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
setlocale
isxdigit
isdigit
strtol
_wtof
_fileno
fread
_filelengthi64
fgetwc
_wfopen
strcspn
localeconv
memchr
sprintf_s
wcscspn
iswdigit
fclose
wcsstr
_wcsnicmp
wcschr
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
_iob
_wtoi
wcsncmp
_ui64tow_s
towlower
wcsnlen
wprintf
towupper
_errno
realloc
memcpy_s
??0exception@@QAE@ABQBD@Z
_vsnwprintf
_wcsicmp
memmove_s
wcsrchr
qsort_s
wcsncpy_s
qsort
iswalnum
iswspace
vwprintf_s
wprintf_s
_except_handler4_common
??1type_info@@UAE@XZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
isalpha
_purecall
_ftol2
_ftol2_sse
memcmp
memcpy
memset

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SetEvent
InitOnceExecuteOnce
CreateEventExW

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
GetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
RoReportFailedDelegate
RoTransformError
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
WindowsCreateString

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoMarshalInterface
CoCopyProxy
RoGetAgileReference
CoReleaseMarshalData
CreateStreamOnHGlobal
CoSetProxyBlanket
CoCreateInstance

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenProcess
GetCurrentProcess
OpenProcessToken

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount
GetSystemTime

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
GetProcAddress

api-ms-win-security-base-l1-2-0

FreeSid
GetLengthSid
AllocateAndInitializeSid
GetTokenInformation
GetAce
EqualSid
AddAccessAllowedAceEx

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringEx
WideCharToMultiByte

oleaut32

VariantChangeTypeEx
SysFreeString
VariantChangeType
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
SysAllocString

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW

api-ms-win-core-file-l1-2-1

SetFilePointer
DeleteFileW
GetFileSize
GetFileSizeEx
CompareFileTime
GetFullPathNameW
FindClose
GetFileAttributesW
FlushFileBuffers
FindNextFileW
FindFirstFileW
WriteFile
GetFileAttributesExW
CreateDirectoryW
CreateFileW
ReadFile
GetFinalPathNameByHandleW
GetTempPathW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-memory-l1-1-2

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-localization-l1-2-1

LCMapStringEx

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRelativePathToW
PathIsRelativeW
PathRemoveBackslashW
PathFileExistsW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpCW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

bcp47langs

??0CLanguage@Internal@Windows@@QAE@PBG@Z
?Compare@CRegion@Internal@Windows@@QBEJABV123@PAN@Z
??0CRegion@Internal@Windows@@QAE@PBG@Z
?IsValidRegionTag@CRegion@Internal@Windows@@SG_NPBG@Z
?GetCompositeRegionCode@CRegion@Internal@Windows@@SGII@Z
?GetSubtagFields@CLanguage@Internal@Windows@@QBEJW4BCP47_SUBTAG_FLAGS@23@PAG@Z
?FindClosestInList@CLanguage@Internal@Windows@@QBEJPBGW4BCP47_COMPARISON_ALGORITHM@23@PAPBGPAN@Z
?IsWellFormedTag@CLanguage@Internal@Windows@@SG_NPBG@Z
?IsValidTag@CLanguage@Internal@Windows@@SG_NPBG@Z
?GetCompositeRegionCode@CRegion@Internal@Windows@@QBEIXZ

shcore

ord170

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetNamedSecurityInfoW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 546KB - Virtual size: 545KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b1a65f74a5068e4c48b018e7f7af2ce

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

oleaut32

api-ms-win-core-debug-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

bcp47langs

shcore

rpcrt4

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-provider-l1-1-0

Exports

Exports

Sections

.text Size: 546KB - Virtual size: 545KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 546KB - Virtual size: 545KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 29KB