Windows[.]Media[.]MediaControl[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Windows.Media.MediaControl.dll
Size

158KB
MD5

8cfc09fb2daa5bfe51810feb776cffb1
SHA1

54854b4f3f41bd02417a61407b9ee129c4566d71
SHA256

ddf706e49ff4cc1e60043a7a71684a92d6bd301cc2d993ce59481354ff581af8
SHA512

31cf40b89bdf06393975868102819e990d0ad18734a0a5bebfe2be7f87449fb9048652c81940b51f4c6c1b0467a784d1447998e1043d21cb7df3ac56d1c48244
SSDEEP

3072:O5eb5V7dEDCGd70VMrTBDeXGc5YB/ozmmjlAIQn7lv+4MSbFKY7AjS:OtoVwcezOlUvtvAS

Score

1^/10

Malware Config

Signatures

Files

Windows.Media.MediaControl.dll
.dll windows:6 windows x86 arch:x86

157741713ba88185198a4042b5d15431

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2013, 21:43

Not After

17/09/2014, 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:4c:81:6e:b9:69:6b:a5:e9:b2:f6:5a:50:04:4f:b8:96:7a:b3:d7:33:68:28:26:61:cc:a7:ae:8e:e1:29:ca
Signer

Actual PE Digest

b4:4c:81:6e:b9:69:6b:a5:e9:b2:f6:5a:50:04:4f:b8:96:7a:b3:d7:33:68:28:26:61:cc:a7:ae:8e:e1:29:ca

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Media.MediaControl.pdb

Imports

msvcrt

_CxxThrowException
memcmp
memcpy
??1type_info@@UAE@XZ
wcschr
_except_handler4_common
__CxxFrameHandler3
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_resetstkoflw
??2@YAPAXI@Z
_onexit
__dllonexit
memcpy_s
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
??3@YAXPAX@Z
memset

rpcrt4

RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
RpcStringBindingComposeW
NdrClientCall2
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_CountRefs
NdrStubCall2
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
Sleep
CreateEventW
InitOnceExecuteOnce
InitOnceInitialize
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
ResetEvent
SetEvent
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetProcessId
GetCurrentThreadId
OpenProcess
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

combase

ord34
ord12
ord10
ord15
ord6
ord90
ord14
ord7
ord16
ord8
ord33
ord13
ord5
ord3
ord4
ord2
ord9
ord32
ord11

api-ms-win-service-private-l1-1-1

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

ntdll

NtQueryInformationProcess
NtQueryInformationToken
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
RtlFreeHeap

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

oleaut32

ord447
ord445
ord446
ord448

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 474B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

157741713ba88185198a4042b5d15431

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b4:4c:81:6e:b9:69:6b:a5:e9:b2:f6:5a:50:04:4f:b8:96:7a:b3:d7:33:68:28:26:61:cc:a7:ae:8e:e1:29:caSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-shcore-stream-winrt-l1-1-0

combase

api-ms-win-service-private-l1-1-1

ntdll

api-ms-win-core-atoms-l1-1-0

oleaut32

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.orpc Size: 512B - Virtual size: 474B

.data Size: 1KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

minATL Size: 512B - Virtual size: 24B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 14KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b4:4c:81:6e:b9:69:6b:a5:e9:b2:f6:5a:50:04:4f:b8:96:7a:b3:d7:33:68:28:26:61:cc:a7:ae:8e:e1:29:ca
Signer

.text
Size: 124KB - Virtual size: 123KB

.orpc
Size: 512B - Virtual size: 474B

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

minATL
Size: 512B - Virtual size: 24B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB