MMDevAPI[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MMDevAPI.dll
Size

358KB
MD5

4bde91c3e30d08ec749db860827be411
SHA1

a28d4d3aa7bf0126ab82b8ff3a34c87992684266
SHA256

cac73df9ccd2efa19eeef47f4c1648c6f73910a3c6e63e853943cad0e1cba724
SHA512

db919ee9cfd19cabe65995f8c7a7259847019a0acf83746f391a24b209eb74d41e4dc245463e4190eeb673be18c5f85bdf7afbd16f7bd2d097b8dd19c36fb536
SSDEEP

6144:UmaYCpxbKM5g7FFrsJrKuehQTqaGCE8Qf4hFY+qPifhKZnKvR/0BC9e/I0XPuKDl:UjvsgduYqMOtORhgaLKrp64

Score

1^/10

Malware Config

Signatures

Files

MMDevAPI.dll
.dll regsvr32 windows:10 windows x86 arch:x86

6d60e28ee938fbae49a0f169eac57f7f

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:03:c5:a2:3c:b3:a5:f4:39:56:85:df:32:4a:0a:c5:2e:c4:b8:bf:77:42:fc:3e:e6:63:fb:2b:4b:d1:e8:e3
Signer

Actual PE Digest

a5:03:c5:a2:3c:b3:a5:f4:39:56:85:df:32:4a:0a:c5:2e:c4:b8:bf:77:42:fc:3e:e6:63:fb:2b:4b:d1:e8:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MMDevAPI.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wtoi
_o_calloc
_o_free
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
_except_handler4_common
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__errno
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
SizeofResource
LoadLibraryExW
GetProcAddress
GetModuleHandleExW
LoadResource
FreeLibrary
LoadStringW
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateEventW
CreateMutexExW
ReleaseSRWLockExclusive
TryEnterCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSemaphore
ReleaseMutex
InitializeSRWLock
DeleteCriticalSection
SetEvent
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared
CreateEventExW
ResetEvent
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegDeleteTreeW
RegEnumValueW
RegQueryValueExW
RegGetValueW
RegOpenKeyExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
TrySubmitThreadpoolCallback
CloseThreadpoolWait
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
ProcessIdToSessionId
GetCurrentProcessId
OpenThread
GetCurrentProcess

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
SetThreadLocale

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

NdrClientCall4
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW

ntdll

EtwUnregisterTraceGuids
RtlGetPersistedStateLocation
EtwGetTraceEnableLevel
RtlQueryPackageClaims
EtwGetTraceEnableFlags
EtwTraceMessage
ShipAssert
EtwLogTraceEvent
EtwNotificationRegister
EtwGetTraceLoggerHandle
EtwNotificationUnregister
EtwSendNotification
RtlDllShutdownInProgress
EtwRegisterTraceGuidsW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-io-l1-1-1

CancelSynchronousIo
GetOverlappedResultEx
CancelIo

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

devobj

DevObjGetDeviceInterfaceProperty
DevObjGetDeviceInterfaceAlias
DevObjGetDeviceInterfacePropertyKeys
DevObjSetDeviceInterfaceProperty
DevObjOpenDeviceInterfaceRegKey
DevObjSetDeviceProperty
DevObjGetDeviceProperty
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjOpenDeviceInterface
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjGetDeviceInstanceId
DevObjEnumDeviceInfo
DevObjGetClassDevs
DevObjDestroyDeviceInfoList

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-service-private-l1-1-0

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

propsys

PropVariantToGUID

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ActivateAudioInterfaceAsync
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 32B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d60e28ee938fbae49a0f169eac57f7f

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a5:03:c5:a2:3c:b3:a5:f4:39:56:85:df:32:4a:0a:c5:2e:c4:b8:bf:77:42:fc:3e:e6:63:fb:2b:4b:d1:e8:e3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

rpcrt4

ntdll

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-realtime-l1-1-0

devobj

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-localization-private-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 312KB - Virtual size: 312KB

RT_BSS Size: - Virtual size: 32B

.data Size: 2KB - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 212B

RT_DATA Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 18KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a5:03:c5:a2:3c:b3:a5:f4:39:56:85:df:32:4a:0a:c5:2e:c4:b8:bf:77:42:fc:3e:e6:63:fb:2b:4b:d1:e8:e3
Signer

.text
Size: 312KB - Virtual size: 312KB

RT_BSS
Size: - Virtual size: 32B

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 212B

RT_DATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 18KB