atmfd[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

atmfd.dll
Size

302KB
MD5

968bf2032fa0da4189dfd05d45c083b0
SHA1

b63ee856a38290f83c019cb97f588ea6f609f0f3
SHA256

5cfd8a7de6ba21cf4756319132d27a958c56dcda8f52cb9ee8abd95735aed58c
SHA512

d98b076da94cdf64d83284518d4165b7480cca9b83542efbdf81afcbd26c3d8579444060dce96f3b8f136944f8aef7ee271f428987acab83e678138323344094
SSDEEP

6144:NDUjaBsVE3rrq5HO3ba9Pkv/leKVVJ6sIBi+blEb1b0OuXChtjyHnpR5:N6FVEnq5HO3baJw/lNVJTIBZblEb1wQI

Score

1^/10

Malware Config

Signatures

Files

atmfd.dll
.dll windows:6 windows x86 arch:x86

5de3f2f2d321ea0bae51b3cf9fdd0ba6

Code Sign

33:00:00:00:f9:5c:c9:22:55:0a:c0:9d:c4:00:00:00:00:00:f9
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:5e:e2:da:26:23:c5:f8:82:2b:00:01:00:00:00:5e
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/09/2018, 20:38

Not After

06/09/2019, 20:38

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0a:59:2b:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

11/02/2016, 23:24

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:69:66:62:00:c0:e6:02:98:46:e2:23:9b:65:4d:41:06:5c:d7:8b
Signer

Actual PE Digest

db:69:66:62:00:c0:e6:02:98:46:e2:23:9b:65:4d:41:06:5c:d7:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atmfd.pdb

Imports

win32k.sys

EngFntCacheFault
EngFntCacheAlloc
EngFntCacheLookUp
EngCreateSemaphore
EngReleaseSemaphore
EngAcquireSemaphore
EngSetLastError
EngMulDiv
XFORMOBJ_iGetXform
FONTOBJ_pxoGetXform
FONTOBJ_pifi
EngGetCurrentCodePage
PATHOBJ_bPolyLineTo
PATHOBJ_bPolyBezierTo
PATHOBJ_bCloseFigure
PATHOBJ_bMoveTo
EngGetFileChangeTime
EngGetFilePath
EngUnmapFontFileFD
EngUnmapFontFile
EngFreeModule
EngAllocMem
EngMapModule
EngLoadModule
EngLoadModuleForWrite
EngMapFontFileFD
EngMapFontFile
EngUnicodeToMultiByteN
EngMultiByteToUnicodeN
EngMultiByteToWideChar
FLOATOBJ_MulFloat
EngFreeMem
FLOATOBJ_GetLong
FLOATOBJ_Neg
FLOATOBJ_AddFloat
FLOATOBJ_Add
FLOATOBJ_DivLong
FLOATOBJ_AddLong
FLOATOBJ_MulLong
FLOATOBJ_SetLong
EngBugCheckEx
RtlUnwind
RtlUnicodeToMultiByteN

Sections

.text
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5de3f2f2d321ea0bae51b3cf9fdd0ba6

Code Sign

33:00:00:00:f9:5c:c9:22:55:0a:c0:9d:c4:00:00:00:00:00:f9Certificate

Extended Key Usages

33:00:00:00:5e:e2:da:26:23:c5:f8:82:2b:00:01:00:00:00:5eCertificate

Extended Key Usages

61:0a:59:2b:00:00:00:00:00:3bCertificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

db:69:66:62:00:c0:e6:02:98:46:e2:23:9b:65:4d:41:06:5c:d7:8bSigner

Headers

File Characteristics

PDB Paths

Imports

win32k.sys

Sections

.text Size: 218KB - Virtual size: 217KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 29KB - Virtual size: 33KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 13KB

33:00:00:00:f9:5c:c9:22:55:0a:c0:9d:c4:00:00:00:00:00:f9
Certificate

33:00:00:00:5e:e2:da:26:23:c5:f8:82:2b:00:01:00:00:00:5e
Certificate

61:0a:59:2b:00:00:00:00:00:3b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

db:69:66:62:00:c0:e6:02:98:46:e2:23:9b:65:4d:41:06:5c:d7:8b
Signer

.text
Size: 218KB - Virtual size: 217KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 29KB - Virtual size: 33KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 13KB