Microsoft[.]Management[.]Infrastructure[.]Native[.]Unmanaged[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Microsoft.Management.Infrastructure.Native.Unmanaged.dll
Size

14KB
MD5

be2ecac7a2e4f96af7903de62807a663
SHA1

d0516d6e6293124c6863288a50bc3d2fe1064c1c
SHA256

0863df068036557a08a6788038b407614ee672001f10cd79f51d49ac0dd65c94
SHA512

61b41164635e98f836457453ccab9afb79572c4af56d9e16682d08469c74c4c37387168e3709268912507553fbce29b541be340ed9b801adcb59c940561c6915
SSDEEP

192:c32EVePjORP9jGgWwnhkSveZTgEGGgE5g1Q6D+GWHCeWOf0:c7VePjePpGgWwnhkyedrHED+GWHCeW5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Microsoft.Management.Infrastructure.Native.Unmanaged.dll

Files

Microsoft.Management.Infrastructure.Native.Unmanaged.dll
.dll windows:6 windows x86 arch:x86

d3ebc3f2c1366051d584c7dbd2a42ac3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.Native.Unmanaged.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
_amsg_exit
_XcptFilter
free
memset

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolWork
CloseThreadpoolWork
SetThreadpoolThreadMinimum
LeaveCriticalSectionWhenCallbackReturns
CloseThreadpool

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
Sleep
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
GetCurrentThreadId
SetThreadToken
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

mi

mi_clientFT_V1

Exports

Exports

GetAddr_OperationCallbacks_ClassObjectNeededCallback
GetAddr_OperationCallbacks_FreeIncludedFileBufferCallback
GetAddr_OperationCallbacks_GetIncludedFileBufferCallback
GetAddr_OperationCallbacks_NativeClassCallback
GetAddr_OperationCallbacks_NativeIndicationCallback
GetAddr_OperationCallbacks_NativeInstanceCallback
GetAddr_OperationCallbacks_NativePromptUserCallback
GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback
GetAddr_OperationCallbacks_NativeWriteErrorCallback
GetAddr_OperationCallbacks_NativeWriteMessageCallback
GetAddr_OperationCallbacks_NativeWriteProgressCallback
GetAddr_SessionHandle_OnReleaseHandleCompleted
MI_ApplicationWrapper_Initialize
MI_ApplicationWrapper_ScheduleCleanupCallback
MI_ApplicationWrapper_SetAppDomainIsUnloading
MI_Helpers_GetCurrentSecurityToken
MI_Helpers_IsClrShuttingDown
MI_Helpers_SetClrIsNotShuttingDown
MI_Helpers_SetClrIsShuttingDown
MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll
MI_OperationWrapper_DecrementCount_AndManageLifetimeOfMiDotNetDll
MI_OperationWrapper_GetClass
MI_OperationWrapper_GetIndication
MI_OperationWrapper_GetInstance
MI_OperationWrapper_Initialize
MI_OperationWrapper_ScheduleDrainingWorkIfNeeded
MI_OperationWrapper_SetupDrainingIfNeeded
UnmanagedMI_GetMiClientFT_V1
UnmanagedMI_GetMiEvaluatorFT_V1
UnmanagedMI_GetMiMonitoringFT_V1
UnmanagedMI_GetMiReactiveExtensionsFT_V1

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3ebc3f2c1366051d584c7dbd2a42ac3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

mi

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 848B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 488B

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 848B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 488B